Configuring Arp Active Acknowledgement; Displaying And Maintaining Arp Defense Against Ip Packet Attacks; Configuring The Arp Active Acknowledgement Function; Configuring Source Mac Address Based Arp Attack Detection - 3Com S7906E Configuration Manual

Displaying and Maintaining ARP Defense Against IP Packet Attacks

To do...
Display the ARP source suppression
configuration information

Configuring ARP Active Acknowledgement

Introduction
Typically, the ARP active acknowledgement feature is configured on gateway devices to identify invalid
ARP packets.
ARP active acknowledgement works before the gateway creates or modifies an ARP entry to avoid
generating any incorrect ARP entry. For details about its working mechanism, refer to ARP Attack
Protection Technology White Paper.

Configuring the ARP Active Acknowledgement Function

Follow these steps to configure ARP active acknowledgement:
To do...
Enter system view
Enable the ARP active
acknowledgement function

Configuring Source MAC Address Based ARP Attack Detection

Introduction
This feature allows the device to check the source MAC address of ARP packets. If the number of ARP
packets sent from a MAC address within five seconds exceeds the specified value, the device
considers this an attack and adds the MAC address to the attack detection table. Before the attack
detection entry is aged out, the device generates an alarm and filters out ARP packets sourced from
that MAC address (in filter mode), or only generates an alarm (in monitor mode).
A gateway or critical server may send a large number of ARP packets. To prevent these ARP packets
from being discarded, you can specify the MAC address of the gateway or server as a protected MAC
address. A protected MAC address is excluded from ARP attack detection even if it is an attacker.
Only the ARP packets delivered to the CPU are detected.
Configuration Procedure
Follow these steps to configure source MAC address based ARP attack detection:
To do...
Enter system view
Use the command...
display arp
source-suppression
Use the command...
system-view
arp anti-attack active-ack
enable
Use the command...
system-view
1-3
Remarks
Available in any view
Remarks
—
Required
Disabled by default.
Remarks
—