Show ip source-guard binding, Arp inspection, Table 56 – Brocade Communications Systems Brocate Ethernet Access Switch 6910 User Manual
Page 279
Brocade 6910 Ethernet Access Switch Configuration Guide
229
53-1002581-01
ARP Inspection
10
show ip source-guard binding
This command shows the source guard binding table.
Syntax
show ip source-guard binding [dhcp-snooping | static]
dhcp-snooping - Shows dynamic entries configured with DHCP Snooping commands (see
)
static - Shows static entries configured with the
command (see
).
Command Mode
Privileged Exec
Example
Console#show ip source-guard binding
MacAddress IpAddress Lease(sec) Type VLAN Interface
----------------- --------------- ---------- -------------------- ---- --------
11-22-33-44-55-66 192.168.0.99 0 Static 1 Eth 1/5
Console#
ARP Inspection
ARP Inspection validates the MAC-to-IP address bindings in Address Resolution Protocol (ARP)
packets. It protects against ARP traffic with invalid address bindings, which forms the basis for
certain “man-in-the-middle” attacks. This is accomplished by intercepting all ARP requests and
responses and verifying each of these packets before the local ARP cache is updated or the packet
is forwarded to the appropriate destination, dropping any invalid ARP packets.
ARP Inspection determines the validity of an ARP packet based on valid IP-to-MAC address bindings
stored in a trusted database – the DHCP snooping binding database. ARP Inspection can also
validate ARP packets against user-configured ARP access control lists (ACLs) for hosts with
statically configured IP addresses.
This section describes commands used to configure ARP Inspection.
TABLE 56
ARP Inspection Commands
Command
Function
Mode
Enables ARP Inspection globally on the switch
GC
Specifies an ARP ACL to apply to one or more VLANs
GC
ip arp inspection log-buffer
logs
Sets the maximum number of entries saved in a log message, and
the rate at these messages are sent
GC
Specifies additional validation of address components in an ARP
packet
GC
Enables ARP Inspection for a specified VLAN or range of VLANs
GC
Sets a rate limit for the ARP packets received on a port
IC
Sets a port as trusted, and thus exempted from ARP Inspection
IC