HP 2650 (J4899A/B), 4100gl, 2626 (J4900A/B) Example of Port Status Screen After Alert Flags Reset

Configuring and Monitoring Port Security

Reading Intrusion Alerts and Resetting Alert Flags

MAC Address of latest

Intruder on Port A1

Earlier intrusions on port A1 that have already been

cleared (that is, the Alert Flag has been reset at least twice before the

most recent intrusion occurred.

Dates and Times of Intrusions

Figure 9-17. Example of the Intrusion Log with Multiple Entries for the Same Port

The above example shows three intrusions for port A1. Since the switch can show only one uncleared intrusion per port, the older two intrusions in this example have already been cleared by earlier use of the clear intrusion-log or the port-security < port-list> clear-intrusion-flag command. (The intrusion log holds up to 20 intrusion records, and deletes intrusion records only when the log becomes full and new intrusions are subsequently added.) The “prior to” text in the record for the third intrusion means that a switch reset occurred at the indicated time and that the intrusion occurred prior to the reset.

To clear the intrusion from port A1 and enable the switch to enter any subsequent intrusion for port A1 in the Intrusion Log, execute the port-security clear-intrusion-flagcommand. If you then re-display the port status screen, you will see that the Intrusion Alert entry for port A1 has changed to “No”. (Executing show port-securityintrusion-logagain will result in the same display as above, and does not include the Intrusion Alert status.)

ProCurve(config)# port-security a1 clear-intrusion-flag ProCurve(config)# show interfaces brief

Intrusion Alert on port A1 is now cleared.

Figure 9-18. Example of Port Status Screen After Alert Flags Reset

For more on clearing intrusions, see “Note on Send-Disable Operation” on page 9-31

9-35