beautypg.com

Configuring arp packet rate limit – H3C Technologies H3C S12500-X Series Switches User Manual

Page 230

background image

218

Figure 68 Network diagram

527B

Configuration considerations

If the attack packets have the same source address, configure the ARP source suppression function as

follows:

1.

Enable ARP source suppression.

2.

Set the threshold to 100. If the number of unresolvable IP packets received from a host within 5
seconds exceeds 100, the device stops resolving packets from the host until the 5 seconds elapse.

If the attack packets have different source addresses, enable the ARP blackhole routing function on the
gateway.

528B

Configuration procedure

# Enable ARP source suppression and set the threshold to 100.

system-view

[Device] arp source-suppression enable

[Device] arp source-suppression limit 100

# Enable ARP blackhole routing.

[Device] arp resolving-route enable

133B

Configuring ARP packet rate limit

The ARP packet rate limit feature allows you to limit the rate of ARP packets to be delivered to the CPU.

For example, if an attacker sends a large number of ARP packets to an ARP detection enabled device, the
device CPU is overloaded because all ARP packets are redirected to the CPU for inspection. As a result,

the device fails to provide other functions or even crash. To solve this problem, you can configure ARP

packet rate limit.

IP network

Gateway

Device

R&D

Office

VLAN 10

VLAN 20

Host A

Host B

Host C

Host D

ARP attack protection