Stp Tc-Protection Threshold - H3C S3100 Series Command Manual

Hide thumbs Also See for S3100 Series:

Table of Contents

<Sysname> system-view

System View: return to User View with Ctrl+Z.

[Sysname] stp tc-protection enable

stp tc-protection threshold

stp tc-protection threshold number

undo stp tc-protection threshold

number: Maximum number of times that a switch can remove the MAC address table and ARP entries

within each 10 seconds, in the range of 1 to 255.

Use the stp tc-protection threshold command to set the maximum number of times that a switch can

remove the MAC address table and ARP entries within each 10 seconds.

Use the undo stp tc-protection threshold command to restore the default.

Normally, a switch removes the MAC address table and ARP entries upon receiving a TC-BPDU. If a

malicious user sends large amount of TC-BPDUs to a switch in a short period, the switch may be busy

in removing the MAC address table and ARP entries, which may affect spanning tree calculation,

occupy a large amount of bandwidth and increase switch CPU utilization.

With the TC-BPDU attack guard function enabled, a switch performs a removing operation upon

receiving a TC-BPDU and triggers a timer (set to 10 seconds by default) at the same time. Before the

timer expires, the switch only performs the removing operation for limited times (up to six times by

default) regardless of the number of the TC-BPDUs it receives. Such a mechanism prevents a switch

from being busy in removing the MAC address table and ARP entries.

You can use the stp tc-protection threshold command to set the maximum times for a switch to

remove the MAC address table and ARP entries in a specific period. When the number of the

TC-BPDUs received within a period is less than the maximum times, the switch performs a removing

operation upon receiving a TC-BPDU. After the number of the TC-BPDUs received reaches the

maximum times, the switch stops performing the removing operation. For example, if you set the

maximum times for a switch to remove the MAC address table and ARP entries to 100 and the switch

receives 200 TC-BPDUs in the period, the switch removes the MAC address table and ARP entries for

only 100 times within the period.

# Set the maximum times for a switch to remove the MAC address table and ARP entries within 10

seconds to 5.

<Sysname>system-view

System View: return to User View with Ctrl+Z.

[Sysname] stp tc-protection threshold 5

Table of Contents