Brocade Communications Systems Brocate Ethernet Access Switch 6910 - Manual (Page 282)

232 Brocade 6910 Ethernet Access Switch Configuration Guide
53-1002581-01
ARP Inspection
10
Default Setting
Message Number: 5
Interval: 1 second
Command Mode
Global Configuration
Command Usage
• ARP Inspection must be enabled with the ip arp inspection command before this command will
be accepted by the switch.
• By default, logging is active for ARP Inspection, and cannot be disabled.
• When the switch drops a packet, it places an entry in the log buffer. Each entry contains flow
information, such as the receiving VLAN, the port number, the source and destination IP
addresses, and the source and destination MAC addresses.
• If multiple, identical invalid ARP packets are received consecutively on the same VLAN, then
the logging facility will only generate one entry in the log buffer and one corresponding system
message.
• The maximum number of entries that can be stored in the log buffer is determined by the
message-number parameter. If the log buffer fills up before a message is sent, the oldest entry
will be replaced with the newest one.
• The switch generates a system message on a rate-controlled basis determined by the seconds
values. After the system message is generated, all entries are cleared from the log buffer.
Example
Console(config)#ip arp inspection log-buffer logs 1 interval 10
Console(config)#
ip arp inspection validate
This command specifies additional validation of address components in an ARP packet. Use the no
form to restore the default setting.
Syntax
ip arp inspection validate {dst-mac [ip] [src-mac] | ip [src-mac] | src-mac}
no ip arp inspection validate
dst-mac - Checks the destination MAC address in the Ethernet header against the target
MAC address in the ARP body. This check is performed for ARP responses. When enabled,
packets with different MAC addresses are classified as invalid and are dropped.
ip - Checks the ARP body for invalid and unexpected IP addresses. Addresses include
0.0.0.0, 255.255.255.255, and all IP multicast addresses. Sender IP addresses are
checked in all ARP requests and responses, while target IP addresses are checked only in
ARP responses.
src-mac - Checks the source MAC address in the Ethernet header against the sender MAC
address in the ARP body. This check is performed on both ARP requests and responses.
When enabled, packets with different MAC addresses are classified as invalid and are
dropped.