Enterasys Networks 9034313-07 manual Logging Invalid Packets, Packet Forwarding, Rate Limiting

Dynamic ARP Inspection Overview

Logging Invalid Packets

By default, DAI writes a log message to the normal buffered log for each invalid ARP packet it drops. You can configure DAI to not log invalid packets for specific VLANs.

Packet Forwarding

DAI forwards valid ARP packets whose destination MAC address is not local. The ingress VLAN could be a switching or routing VLAN. ARP requests are flooded in the VLAN. ARP responses are unicast toward their destination. DAI queries the MAC address table to determine the outgoing port. If the destination MAC address is local, DAI gives valid ARP packets to the ARP application.

Rate Limiting

To protect the switch from DHCP attacks when DAI is enabled, the DAI application enforces a rate limit for ARP packets received on untrusted interfaces. DAI monitors the receive rate on each interface separately. If the receive rate exceeds a configurable limit, DAI error disables the interface, which effectively brings down the interface. You can use the set port enable command to reenable the port.

You can configure both the rate and the burst interval. The default rate is 15 pps on each untrusted interface with a range of 0 to 100 pps. The default burst interval is 1 second with a range to 1 to 15 seconds.. The rate limit cannot be set on trusted interfaces since ARP packets received on trusted interfaces do not come to the CPU.

Eligible Interfaces

Dynamic ARP inspection is enabled per VLAN, effectively enabling DAI on the members of the VLAN, either physical ports or LAGs. Trust is specified on the VLAN members.

DAI cannot be enabled on port‐based routing interfaces. It may be connected to:

•A single host through a trusted link (for example, a server)

•If multiple hosts need to connected, there must be a switch between the router and the hosts, with DAI enabled on that switch

Interaction with Other Functions

•DAI relies on the DHCP snooping application to verify that a {IP address, MAC address, VLAN, interface} tuple is valid.

•DAI registers with dot1q to receive notification of VLAN membership changes for the VLANs where DAI is enabled.

•DAI tells the driver about each untrusted interface (physical port or LAG) where DAI is enabled so that the hardware will intercept ARP packets and send them to the CPU.

SecureStack C3 Configuration Guide 17-17