Command Manual (For Soliton) – MSTP
H3C S3100 Series Ethernet Switches
Chapter 1 MSTP Configuration Commands
1-53
Because of configuration errors or malicious attacks, the valid root bridge in the
network may receive configuration BPDUs with their priorities higher than that of the
root bridge, which causes new root bridge to be elected and network topology jitter to
occur. In this case, flows that should have traveled along high-speed links are led to
low-speed links, causing network congestion.
You can avoid this problem by utilizing the root guard function. Root-guard-enabled
ports can only be kept as designated ports in all spanning tree instances. When a port
of this type receives configuration BPDUs with higher priorities, it turns to the discarding
state before it is specified as a non-designated port and stops forwarding packets (as if
it is disconnected from the link).
Related commands:
stp interface root-protection
.
Examples
# Enable the root guard function on Ethernet 1/0/1.
<Sysname> system-view
System View: return to User View with Ctrl+Z.
[Sysname] interface Ethernet 1/0/1
[Sysname-Ethernet1/0/1] stp root-protection
1.1.48 stp tc-protection
Syntax
stp tc-protection enable
stp
tc-protection disable
View
System view
Parameters
None
Description
Use the
stp tc-protection enable
command to enable the TC-BPDU attack guard
function.
Use the
stp tc-protection disable
command to disable the TC-BPDU attack guard
function.
By default, the TC-BPDU guard attack function is enabled, and the MAC address table
and ARP entries can be removed for up to six times within 10 seconds.
Normally, a switch removes the MAC address table and ARP entries upon receiving
TC-BPDUs. If a malicious user sends a large amount of TC-BPDUs to a switch in a
short period, the switch may be busy in removing the MAC address table and ARP
