H3C Technologies H3C S5560 Series Switches - Manual (Page 26)

11
Configuring gratuitous ARP
Overview
In a gratuitous ARP packet, the sender IP address and the target IP address are the IP address of the
sending device.
A device sends a gratuitous ARP packet for either of the following purposes:
• Determine whether its IP address is already used by another device. If the IP address is already used,
the device is informed of the conflict by an ARP reply.
• Inform other devices of a MAC address change.
Gratuitous ARP packet learning
This feature enables a device to create or update ARP entries by using the sender IP and MAC addresses
in received gratuitous ARP packets.
When this feature is disabled, the device uses received gratuitous ARP packets to update existing ARP
entries only. ARP entries are not created based on the received gratuitous ARP packets, which saves ARP
table space.
Periodic sending of gratuitous ARP packets
Enabling periodic sending of gratuitous ARP packets helps downstream devices update ARP entries or
MAC entries in a timely manner. This feature implements the following functions:
• Prevent gateway spoofing.
Gateway spoofing occurs when an attacker uses the gateway address to send gratuitous ARP
packets to the hosts on a network. The traffic destined for the gateway from the hosts is sent to the
attacker instead. As a result, the hosts cannot access the external network.
To prevent such gateway spoofing attacks, you can enable the gateway to send gratuitous ARP
packets at intervals. Gratuitous ARP packets contain the primary IP address and manually
configured secondary IP addresses of the gateway, so hosts can then learn correct gateway
information.
• Prevent ARP entries from aging out.
If network traffic is heavy or if the host CPU usage is high, received ARP packets can be discarded
or are not promptly processed. Eventually, the dynamic ARP entries on the receiving host age out.
The traffic between the host and the corresponding devices is interrupted until the host re-creates
the ARP entries.
To prevent this problem, you can enable the gateway to send gratuitous ARP packets periodically.
The receiving hosts can update ARP entries in time.
• Prevent the virtual IP address of a VRRP group from being used by a host.
The master router of a VRRP group can periodically send gratuitous ARP packets to the hosts on the
local network. The hosts can then update local ARP entries and avoid using the virtual IP address
of the VRRP group. The sender MAC address in the gratuitous ARP packet is the virtual MAC