37-1
37
ARP Attack Defense Configuration
ARP
rk
attacks. Currently, ARP attacks and viruses are threatening LAN security. The device can provide
.
Introduction to Maximum Number of Dynamic ARP Entries a VLAN Interface Can
Learn
VLAN interface can learn. If the number of ARP entries learned by the
VLAN interface exceeds the specified upper limit, the VLAN interface stops learning ARP entries, thus
Introd
her host as the sender IP or MAC address of ARP
g as gateways). With this function, the device can verify whether an
P
C
d
z
stent, the packet passes the check and the switch learns the ARP entry.
z
If they are not consistent, the ARP packet is considered invalid and the corresponding ARP entry is
Introduction to ARP Attack Detection
Man-in-the-
t adds the IP-to-MAC mapping of
Attack Defense Configuration
Although ARP is easy to implement, it provides no security mechanism and thus is prone to netwo
multiple features to detect and prevent such attacks. This chapter mainly introduces these features
To prevent ARP flood attacks, you can limit the number of ARP entries learned by a VLAN interface on
S4500 series Ethernet switches (operating as gateways). That is, you can set the maximum number of
dynamic ARP entries that a
to avoid ARP flood attacks.
uction to ARP Source MAC Address Consistency Check
An attacker may use the IP or MAC address of anot
packets. These ARP packets can cause other network devices to update the corresponding ARP
entries incorrectly, thus interrupting network traffic.
To prevent such attacks, you can configure ARP source MAC address consistency check on S4500
series Ethernet switches (operatin
AR packet is valid by checking the sender MAC address of the ARP packet against the source MA
ad ress in the Ethernet header.
If they are consi
not learned.
middle attack
According to the ARP design, after receiving an ARP response, a hos
the sender into its ARP mapping table even if the MAC address is not the real one. This can reduce the
ARP traffic in the network, but it also makes ARP spoofing possible.
In
Figure 37-1
, Host A communicates with Host C through a switch. To intercept the traffic between Host
A and Host C, the hacker (Host B) forwards invalid ARP reply messages to Host A and Host C
respectively, causing the two hosts to update the MAC address corresponding to the peer IP address in
their ARP tables with the MAC address of Host B. Then, the traffic between Host A and C will pass
through Host B which acts like a “man-in-the-middle” that may intercept and modify the communication
information. Such an attack is called man-in-the-middle attack.
