Configuring Source Mac-Based Arp Attack Detection; Configuration Procedure; Displaying And Maintaining Source Mac-Based Arp Attack Detection - HP FlexFabric 5930 Series Security Configuration Manual

Configuring source MAC-based ARP attack
detection
This feature checks the number of ARP packets received from the same MAC address within 5 seconds
against a specific threshold. If the threshold is exceeded, the device adds the MAC address in an ARP
attack entry. Before the entry is aged out, the device handles the attack by using either of the following
methods:
• Monitor—Only generates log messages.
Filter—Generates log messages and filters out subsequent ARP packets from that MAC address.
•
You can exclude the MAC addresses of some gateways and servers from this detection. This feature does
not inspect ARP packets from those devices even if they are attackers.

Configuration procedure

To configure source MAC-based ARP attack detection:
Step
1. Enter system view.
2. Enable source MAC-based
ARP attack detection and
specify the handling method.
3. Configure the threshold.
4. Configure the aging timer for
ARP attack entries.
5. (Optional.) Exclude specified
MAC addresses from this
detection.
NOTE:
When an ARP attack entry expires, ARP packets sourced from the MAC address in the entry can be
processed correctly.
Displaying and maintaining source MAC-based ARP attack
detection
Execute display commands in any view.
Task
Display ARP attack entries detected by source
MAC-based ARP attack detection.
Command
system-view
arp source-mac { filter | monitor }
arp source-mac threshold
threshold-value
arp source-mac aging-time time
arp source-mac exclude-mac
mac-address&<1-10>
Command
display arp source-mac { slot slot-number | interface
interface-type interface-number }
157
Remarks
N/A
By default, this feature is disabled.
The default threshold is 30.
By default, the lifetime is 300
seconds.
By default, no MAC address is
excluded.