Cisco Systems 4500 Limiting the Rate of Incoming ARP Packets

46-16
Software Configuration Guide—Release 15.0(2)SG
OL-23818-01
Chapter 46 Configuring Dynamic ARP Inspection
Configuring Dynamic ARP Inspection
To return to the default log buffer settings, use the no ip arp inspection log-buffer global configuration
command. To return to the default VLAN log settings, use the
no ip arp inspection vlan vlan-range logging {acl-match | dhcp-bindings} global configuration
command. To clear the log buffer, use the clear ip arp inspection log privileged EXEC command.
This example shows how to configure the number of entries for the log buffer to 1024. It also shows how
to configure your Catalyst 4500 series switch so that the logs must be generated from the buffer at the
rate of 100 per 10 seconds.
SwitchB# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
SwitchB(config)# ip arp inspection log-buffer entries 1024
SwitchB(config)# ip arp inspection log-buffer logs 100 interval 10
SwitchB(config)# end
SwitchB# show ip arp inspection log
Total Log Buffer Size : 1024
Syslog rate : 100 entries per 10 seconds.
Interface Vlan Sender MAC Sender IP Num Pkts Reason Time
---------- ---- -------------- --------------- --------- ----------- ----
Gi3/31 100 0002.0002.0003 170.1.1.2 5 DHCP Deny 02:05:45 UTC
Fri Feb 4 2005
SwitchB#
Limiting the Rate of Incoming ARP Packets
The switch CPU performs DAI validation checks; therefore, the number of incoming ARP packets is
rate-limited to prevent a denial-of-service attack.
Note Unless you explicitly configure a rate limit on an interface, changing the trust state of the interface also
changes its rate limit to the default value for that trust state. After you configure the rate limit, the
interface retains the rate limit even when its trust state is changed. If you enter the
no ip arp-inspection limit interface configuration command, the interface reverts to its default rate
limit.
By default, the switch places the port in the error-disabled state when the rate of incoming ARP packets
exceeds the configured limit. To prevent the port from shutting do wn, you can use the errdisable detect
cause arp-inspection action shutdown vlan global configuration command to shut down just the
offending VLAN on the port where the violation occurred.
When a port is in the error-disabled state, you can bring it out of this state automatically by configuring
the errdisable recovery cause arp-inspection global configuration command or you can manually
reenable it by entering the shutdown and no shut down interface configuration commands. If a port is
in per-VLAN error-disable mode, you can also use clear errdisable interface name vlan range
command to reenable the VLAN on the port.
Step 5 Switch# show ip arp inspection
log Verifies your settings.
Step 6 Switch# copy running-config
startup-config (Optional) Saves your entries in the configuration file.
Command Purpose