Introduction To Arp Security; Arp Security Supported By The S9300 - Huawei Quidway S9300 Configuration Manual

4 ARP Security Configuration

4.1 Introduction to ARP Security

This section describes the principle of ARP security.
ARP Attack
On a network, ARP entries are easily attacked. Attackers send a large number of ARP Request
and Response packets to attack network devices. Attacks are classified into ARP buffer overflow
attacks and ARP Denial of Service (DoS) attacks.
l
l
Attackers scan hosts on the local network segment or hosts on other network segments through
tools. Before returning response packets, the S9300 searches for ARP entries. If the MAC address
corresponding to the destination IP address does not exist, the ARP module on the S9300 sends
ARP Miss messages to the upper-layer software and requires the upper-layer software to send
ARP request packets to obtain the destination MAC address. A large number of scanning packets
generate a large number of ARP Miss packets. The resources of the system are then wasted in
processing ARP Miss packets. This affects the processing of other services and hence is called
scanning attack.
ARP Security
ARP security is used to filter out untrusted ARP packets and enable timestamp suppression for
certain ARP packets to guarantee the security and robustness of network devices.

4.2 ARP Security Supported by the S9300

This section describes the ARP security features supported by the S9300.
The S9300 supports the following ARP security features.
Limitation on ARP Entry Learning
You can configure the strict ARP entry learning so that the S9300 can learn only the response
messages of the ARP requests sent locally.
You can set the maximum number of ARP entries that can be dynamically learned by an
interface. This prevents malicious use of ARP entries and ensures that the S9300 can learn the
ARP entries of authorized users.
ARP Anti-Spoofing
ARP spoofing means that attackers use ARP packets sent by other users to construct bogus ARP
packets and modify ARP entries on the gateway. As a result, the authorized users are
disconnected from the network.
4-2
ARP buffer overflow attacks: Attackers send a large number of bogus ARP request packets
and gratuitous ARP packets, which results in ARP buffer overflow. Therefore, normal ARP
entries cannot be cached and packet forwarding is interrupted.
ARP DoS attacks: Attackers send a large number of ARP request and response packets or
other packets that can trigger the ARP processing. The device is then busy with ARP
processing during a long period and ignores other services. Normal packet forwarding is
thus interrupted.
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
Quidway S9300 Terabit Routing Switch
Configuration Guide - Security
Issue 01 (2009-07-28)