Configuring Arp Packet Rate Limit - HP A5830 Series Configuration Manual

Configuration considerations
If the attacking packets have the same source address, you can enable the ARP source suppression
function by doing the following:
Enable ARP source suppression.
•
Set the threshold for ARP packets from the same source address to 100. If the number of ARP
•
requests sourced from the same IP address in 5 seconds exceeds 100, the device suppresses the IP
packets sourced from this IP address from triggering any ARP requests within the following 5
seconds.
If the attacking packets have different source addresses, enable the ARP black hole routing function on
the device.
Configuration procedure
ARP source suppression configuration
1.
# Enable ARP source suppression on the device, and set the threshold for ARP packets from the same
source address to 100.
<Device> system-view
[Device] arp source-suppression enable
[Device] arp source-suppression limit 100
ARP black hole routing configuration
2.
# Enable ARP black hole routing on the device.
<Device> system-view
[Device] arp resolving-route enable

Configuring ARP packet rate limit

The ARP packet rate limit feature allows you to limit the rate of ARP packets to be delivered to the CPU
on a switch. For example, if an attacker sends a large number of ARP packets to an ARP detection
enabled device, the CPU of the device becomes overloaded because all the ARP packets are redirected
to the CPU for checking. As a result, the device fails to deliver other functions properly or even crashes.
To solve this problem, configure ARP packet rate limit.
Enable this feature after the ARP detection feature is configured, or use this feature to prevent ARP flood
attacks.
To configure ARP packet rate limit:
To do...
1. Enter system view.
2. Enter Layer 2 Ethernet
interface/Layer 2
aggregate interface view.
3. Configure ARP packet rate
limit.
Use the command...
system-view
interface interface-type
interface-number
arp rate-limit { disable | rate
pps drop }
226
Remarks
—
—
Required.
By default, the ARP packet rate limit is
enabled and is 100 pps.