Configuring Source Mac Address Based Arp Attack Detection; Configuration Procedure - HP 5500 HI Series Configuration Manual

If you enable ARP packet rate limit on a Layer 2 aggregate interface, trap and log messages are sent
when the ARP packet rate of a member port exceeds the preset threshold rate.
To configure ARP packet rate limit:
Step
1. Enter system view.
2. Enable ARP packet rate limit
trap.
3. Set the interval for sending
trap and log messages when
ARP packet rate exceeds the
specified threshold rate.
4. Enter Layer 2 Ethernet
interface/Layer 2 aggregate
interface view.
5. Configure ARP packet rate
limit.
Configuring source MAC address based ARP
attack detection
With this feature enabled, the device checks the source MAC address of ARP packets delivered to the
CPU. It detects an attack when one MAC address sends more ARP packets in 5 seconds than the
specified threshold. The device adds the MAC address to the attack detection table.
Before the attack detection entry is aged out, the device uses either of the following detection modes to
respond to the detected attack:
Monitor mode—Generates a log message.
•
• Filter mode—Generates a log message and filters out subsequent ARP packets from the attacking
MAC address.
You can also configure protected MAC addresses to exclude a gateway or server from detection. A
protected MAC address is excluded from ARP attack detection even if it is an attacker.

Configuration procedure

To configure source MAC address based ARP attack detection:
Step
1. Enter system view.
Command
system-view
snmp-agent trap enable arp
rate-limit
arp rate-limit information interval
seconds
interface interface-type
interface-number
arp rate-limit { disable | rate pps
drop }
Command
system-view
373
Remarks
N/A
Optional.
Enabled by default.
For more information, see the
snmp-agent trap enable arp
command in Network Management
and Monitoring Command
Reference.
Optional.
60 seconds by default.
N/A
By default, ARP packet rate limit is
disabled.
Remarks
N/A