HP ProCurve Switch 2900yl-24G Access Security Manual page 337

ProCurve Switch 2900yl-24G(config)# show interfaces brief
Status and Counters - Port Status
Port Type
----- --------- + --------- ------- ------ ---------- ----- ----- ------
1 100/1000T | Yes
2 100/1000T | No
3 100/1000T | No
4 100/1000T | No
5 100/1000T | No
6 100/1000T | No
7 100/1000T | No
8 100/1000T | No
9 100/1000T | No
Figure 10-16.Example of an Unacknowledged Intrusion Alert in a Port Status Display
MAC Address of latest
Intruder on Port A1
Earlier intrusions on
port A1 that have
already been cleared
(that is, the Alert Flag
has been reset at least
twice before the most
recent intrusion
Figure 10-17.Example of the Intrusion Log with Multiple Entries for the Same Port
| Intrusion
| Alert Enabled Status Mode
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
If you wanted to see the details of the intrusion, you would then enter the show
port-security intrusion-log command. For example:
The above example shows three intrusions for port A1. Since the switch can
show only one uncleared intrusion per port, the older two intrusions in this
example have already been cleared by earlier use of the clear intrusion-log or
the port-security < port-list > clear-intrusion-flag command. (The intrusion log
holds up to 20 intrusion records, and deletes intrusion records only when the
log becomes full and new intrusions are subsequently added.) The "prior to"
text in the record for the third intrusion means that a switch reset occurred
at the indicated time and that the intrusion occurred prior to the reset.
Configuring and Monitoring Port Security
Reading Intrusion Alerts and Resetting Alert Flags
Intrusion Alert on port 1.
Down 1000FDx
Down 1000FDx
Down 1000FDx
Down 1000FDx
Down 1000FDx
Down 1000FDx
Down 1000FDx
Down 1000FDx
Down 1000FDx
MDI Flow Bcast
Mode Ctrl Limit
Auto off 0
Auto off 0
Auto off 0
Auto off 0
Auto off 0
Auto off 0
Auto off 0
Auto off 0
Auto off 0
Dates and Times
of Intrusions
10-39