Displaying And Maintaining Arp Source Suppression; Configuring Arp Defense Against Ip Packet Attacks; Introduction To Arp Defense Against Ip Packet Attacks; Enabling Arp Defense Against Ip Packet Attacks - 3Com 4510G Configuration Manual

Displaying and Maintaining ARP Source Suppression

To do...
Display the ARP source suppression
configuration information

Configuring ARP Defense Against IP Packet Attacks

Introduction to ARP Defense Against IP Packet Attacks

When forwarding an IP packet, a device depends on ARP to resolve the MAC address of the next hop.
If the address resolution is successful, the forwarding chip forwards the packet directly. Otherwise, the
device runs software for further processing. If the device cannot resolve the next hops for large
numbers of incoming packets, the CPU of the device will be exhausted. This is called IP packet
attacks.
To protect a device against IP packet attacks, you can enable the ARP defense against IP packet
attacks function. After receiving an IP packet whose next hop cannot be resolved by ARP, a device with
this function enabled creates a black hole route immediately and the forwarding chip simply drops all
packets matching the next hop during the age time of the black hole route.

Enabling ARP Defense Against IP Packet Attacks

The ARP defense against IP packet attack function applies to packets to be forwarded and those
originated by the device.
Follow these steps to configure ARP defense against IP packet attacks:
Enter system view
Enable ARP defense against IP packet
attacks

Configuring ARP Active Acknowledgement

Introduction

Typically, the ARP active acknowledgement feature is configured on gateway devices to identify invalid
ARP packets.
With this feature enabled, the gateway, upon receiving an ARP packet with a different source MAC
address from that in the corresponding ARP entry, checks whether the ARP entry has been updated
within the last minute:
If yes, the gateway does not update the ARP entry;
If not, the gateway unicasts an ARP request to the source MAC address of the ARP entry.
Then,
If an ARP reply is received within five seconds, the ARP packet is ignored;
If not, the gateway unicasts an ARP request to the MAC address of the ARP packet.
To do...
Use the command...
display arp source-suppression
Use the command...
system-view
arp resolving-route enable
4-2
Remarks
Available in any view
Remarks
—
Optional
Enabled by default.