H3C S3100 Series Command Manual page 401

After system-guard is enabled on a port, if the number of packets the port received and sent to the
CPU in a specified interval exceeds the specified threshold, the system considers that the port is
under attack and begins to limit the packet receiving rate on the port (this function is also called
inbound rate limit). if the rate of incoming packets on the port exceeds the threshold of inbound rate
limit, any service packets, including BPDU packets, are possible to be dropped at random, which
may result in state transition of STP.
The system–guard function is not applicable to the uplink port of an S3100-SI switch.
Example
# Apply the system-guard function to Ethernet1/0/1 through Ethernet1/0/10 ports.
<Sysname> system-view
System View: return to User View with Ctrl+Z.
[Sysname] system-guard permit Ethernet 1/0/1 to Ethernet 1/0/10
5-4