03-ARP Commands
Chapters Download (95.99 KB)
Table of Contents
Gratuitous ARP Configuration Commands
gratuitous-arp-learning enable
2 ARP Attack Defense Configuration Commands
ARP Source Suppression Configuration Commands
display arp source-suppression
ARP Active Acknowledgement Configuration Commands
arp anti-attack active-ack enable
Source MAC Address Based ARP Attack Detection Configuration Commands
arp anti-attack source-mac aging-time
arp anti-attack source-mac exclude-mac
arp anti-attack source-mac threshold
display arp anti-attack source-mac
ARP Packet Source MAC Address Consistency Check Configuration Commands
arp anti-attack valid-ack enable
ARP Packet Rate Limit Configuration Commands
ARP Detection Configuration Commands
display arp detection statistics
reset arp detection statistics
Syntax
arp check enable
undo arp check enable
View
System view
Default Level
2: System level
Parameters
None
Description
Use the arp check enable command to enable ARP entry check. With this function enabled, the device cannot learn any ARP entry with a multicast MAC address. Configuring such a static ARP entry is not allowed either; otherwise, the system displays error messages.
Use the undo arp check enable command to disable the function. After the ARP entry check is disabled, the device can learn the ARP entry with a multicast MAC address, and you can also configure such a static ARP entry on the device.
By default, ARP entry check is enabled.
Examples
# Enable ARP entry check.
<Sysname> system-view
[Sysname] arp check enable
Syntax
arp max-learning-num number
undo arp max-learning-num
View
Ethernet interface view, VLAN interface view, Layer-2 aggregate interface view
Default Level
2: System level
Parameters
number: Maximum number of dynamic ARP entries that an interface can learn. in the range 0 to 1024
Description
Use the arp max-learning-num command to configure the maximum number of dynamic ARP entries that an interface can learn.
Use the undo arp max-learning-num command to restore the default.
By default, the maximum number of dynamic ARP entries that a interface can learn is 1024.
Examples
# Specify VLAN-interface 40 to learn up to 500 dynamic ARP entries.
<Sysname> system-view
[Sysname] interface vlan-interface 40
[Sysname-Vlan-interface40] arp max-learning-num 500
# Specify GigabitEthernet 1/0/1 to learn up to 1000 dynamic ARP entries.
<Sysname> system-view
[Sysname] interface GigabitEthernet 1/0/1
[Sysname-GigabitEthernet1/0/1] arp max-learning-num 1000
# Specifiy Layer-2 aggregate interface Bridge-aggregation 1 to learn up to 1000 dynamic ARP entries.
<Sysname> system-view
[Sysname] interface bridge-aggregation 1
[Sysname-Bridge-Aggregation1] arp max-learning-num 1000
Syntax
arp static ip-address mac-address [ vlan-id interface-type interface-number ]
undo arp ip-address
View
System view
Default Level
2: System level
Parameters
ip-address: IP address in an ARP entry.
mac-address: MAC address in an ARP entry, in the format H-H-H.
vlan-id: ID of a VLAN to which a static ARP entry belongs to, in the range 1 to 4094.
interface-type interface-number: Interface type and interface number.
Description
Use the arp static command to configure a static ARP entry in the ARP mapping table.
Use the undo arp command to remove an ARP entry.
Note that:
l A static ARP entry is effective when the device works normally. However, when the VLAN or VLAN interface to which an ARP entry corresponds is deleted, the entry, if permanent, will be deleted, and if non-permanent and resolved, will become unresolved.
l The vlan-id argument is used to specify the corresponding VLAN of an ARP entry and must be the ID of an existing VLAN. In addition, the Ethernet interface following the argument must belong to that VLAN. The VLAN interface of the VLAN must have been created.
l If both the vlan-id and ip-address arguments are specified, the IP address of the VLAN interface corresponding to the vlan-id argument must belong to the same network segment as the IP address specified by the ip-addres argument.
Related commands: reset arp, display arp.
Examples
# Configure a static ARP entry, with the IP address being 202.38.10.2, the MAC address being 00e0-fc01-0000, and the outbound interface being GigabitEthernet1/0/1 of VLAN 10.
<Sysname> system-view
[Sysname] arp static 202.38.10.2 00e0-fc01-0000 10 GigabitEthernet 1/0/1
Syntax
arp timer aging aging-time
undo arp timer aging
View
System view
Default Level
2: System level
Parameters
aging-time: Aging time for dynamic ARP entries in minutes, in the range 1 to 1,440.
Description
Use the arp timer aging command to set aging time for dynamic ARP entries.
Use the undo arp timer aging command to restore the default.
By default, the aging time for dynamic ARP entries is 20 minutes.
Related commands: display arp timer aging.
Examples
# Set aging time for dynamic ARP entries to 10 minutes.
<Sysname> system-view
Syntax
display arp [ [ all | dynamic | static ] | vlan vlan-id | interface interface-type interface-number ] [ [ | { begin | exclude | include } regular-expression ] | count ]
View
Any view
Default Level
1: Monitor level
Parameters
all: Displays all ARP entries.
dynamic: Displays dynamic ARP entries.
static: Displays static ARP entries.
vlan vlan-id: Displays the ARP entries of the specified VLAN. The VLAN ID ranges from 1 to 4,094.
interface interface-type interface-number: Displays the ARP entries of the interface specified by the argument interface-type interface-number.
|: Uses a regular expression to specify the ARP entries to be displayed. For detailed information about regular expressions, refer to Basic System Configuration in the System Volume.
begin: Displays ARP entries from the first one containing the specified string.
exclude: Displays the ARP entries that do not contain the specified string.
include: Displays the ARP entries containing the specified string.
regular-expression: A case-sensitive string for matching, consisting of 1 to 256 characters.
count: Displays the number of ARP entries.
Description
Use the display arp command to display ARP entries in the ARP mapping table.
If no parameter is specified, all ARP entries are displayed.
Related commands: arp static, reset arp.
Examples
# Display the detailed information of all ARP entries.
Type: S-Static D-Dynamic
IP Address MAC Address VLAN ID Interface Aging Type
1.1.1.1 0001-0001-0001 1 GE1/0/2 N/A S
192.168.1.1 00e0-fc01-0000 1 GE1/0/1 N/A S
Table 1-1 display arp command output description
|
Field |
Description |
|
IP Address |
IP address in an ARP entry |
|
MAC Address |
MAC address in an ARP entry |
|
VLAN ID |
VLAN ID contained a static ARP entry |
|
Interface |
Outbound interface in an ARP entry |
|
Aging |
Aging time for a dynamic ARP entry in minutes (“N/A” means unknown aging time or no aging time) |
|
Type |
ARP entry type: D for dynamic, S for static |
# Display the number of all ARP entries.
<Sysname> display arp all count
Total Entry(ies): 2
Syntax
display arp ip-address [ | { begin | exclude | include } regular-expression ]
View
Any view
Default Level
1: Monitor level
Parameters
ip-address: Displays the ARP entry for the specified IP address.
|: Uses a regular expression to specify the ARP entries to be displayed. For detailed information about regular expressions, refer to Basic System Configuration in the System Volume.
begin: Displays the ARP entries from the first one containing the specified string.
exclude: Displays the ARP entries that do not contain the specified string.
include: Displays the ARP entries that contain the specified string.
regular-expression: A case-sensitive string for matching, consisting of 1 to 256 characters.
Description
Use the display arp ip-address command to display the ARP entry for a specified IP address.
Related commands: arp static, reset arp.
Examples
# Display the corresponding ARP entry for the IP address 20.1.1.1.
<Sysname> display arp 20.1.1.1
Type: S-Static D-Dynamic
IP Address MAC Address VLAN ID Interface Aging Type
20.1.1.1 00e0-fc00-0001 N/A GE1/0/2 N/A S
Syntax
display arp timer aging
View
Any view
Default Level
2: System level
Parameters
None
Description
Use the display arp timer aging command to display the aging time for dynamic ARP entries.
Related commands: arp timer aging.
Examples
# Display the aging time for dynamic ARP entries.
<Sysname> display arp timer aging
Current ARP aging time is 10 minute(s)
Syntax
reset arp { all | dynamic | static | interface interface-type interface-number }
View
User view
Default Level
2: System level
Parameters
all: Clears all ARP entries except authorized ARP entries.
dynamic: Clears all dynamic ARP entries.
static: Clears all static ARP entries.
interface interface-type interface-number: Clears the ARP entries for the interface specified by the argument interface-type interface-number.
Description
Use the reset arp command to clear ARP entries except authorized ARP entries from the ARP mapping table.
With interface interface-type interface-number specified, the command clears only dynamic ARP entries of the interface.
Related commands: arp static, display arp.
Examples
# Clear all static ARP entries.
<Sysname> reset arp static
Syntax
gratuitous-arp-sending enable
undo gratuitous-arp-sending enable
View
System view
Default Level
2: System level
Parameters
None
Description
Use the gratuitous-arp-sending enable command to enable a device to send gratuitous ARP packets when receiving ARP requests from another network segment.
Use the undo gratuitous-arp-sending enable command to restore the default.
By default, a device cannot send gratuitous ARP packets when receiving ARP requests from another network segment.
Examples
# Disable a device from sending gratuitous ARP packets.
<Sysname> system-view
[Sysname] undo gratuitous-arp-sending enable
Syntax
gratuitous-arp-learning enable
undo gratuitous-arp-learning enable
View
System view
Default Level
2: System level
Parameters
None
Description
Use the gratuitous-arp-learning enable command to enable the gratuitous ARP packet learning function.
Use the undo gratuitous-arp-learning enable command to disable the function.
By default, the function is enabled.
With this function enabled, a device receiving a gratuitous ARP packet can add the source IP and MAC addresses carried in the packet to its own dynamic ARP table if it finds no ARP entry in the cache corresponding to the source IP address of the ARP packet exists; if the corresponding ARP entry exists in the cache, the device updates the ARP entry regardless of whether this function is enabled.
Examples
# Enable the gratuitous ARP packet learning function.
<Sysname> system-view
Syntax
arp source-suppression enable
undo arp source-suppression enable
View
System view
Default Level
2: System level
Parameters
None
Description
Use the arp source-suppression enable command to enable the ARP source suppression function.
Use the undo arp source-suppression enable command to disable the function.
By default, the ARP source suppression function is disabled.
Related commands: display arp source-suppression.
Examples
# Enable the ARP source suppression function.
<Sysname> system-view
[Sysname] arp source-suppression enable
Syntax
arp source-suppression limit limit-value
undo arp source-suppression limit
View
System view
Default Level
2: System level
Parameters
limit-value: Specifies the maximum number of packets with the same source IP address but unresolvable destination IP addresses that the device can receive in five seconds. It ranges from 2 to 1024.
Description
Use the arp source-suppression limit command to set the maximum number of packets with the same source IP address but unresolvable destination IP addresses that the device can receive in five seconds.
Use the undo arp source-suppression limit command to restore the default value, which is 10.
With this feature configured, whenever the number of packets with unresolvable destination IP addresses from a host within five seconds exceeds the specified threshold, the device suppress the sending host from triggering any ARP requests within the following five seconds.
Related commands: display arp source-suppression.
Examples
# Set the maximum number of packets with the same source address but unresolvable destination IP addresses that the device can receive in five seconds to 100.
<Sysname> system-view
[Sysname] arp source-suppression limit 100
Syntax
display arp source-suppression
View
Any view
Default Level
2: System level
Parameters
None
Description
Use the display arp source-suppression command to display information about the current ARP source suppression configuration.
Examples
# Display information about the current ARP source suppression configuration.
<Sysname> display arp source-suppression
ARP source suppression is enabled
Current suppression limit: 100
Current cache length: 16
Table 2-1 display arp source-suppression command output description
|
Field |
Description |
|
ARP source suppression is enabled |
The ARP source suppression function is enabled |
|
Current suppression limit |
Maximum number of packets with the same source IP address but unresolvable IP addresses that the device can receive in five seconds |
|
Current cache length |
Size of cache used to record source suppression information |
Syntax
arp anti-attack active-ack enable
undo arp anti-attack active-ack enable
View
System view
Default Level
2: System level
Parameters
None
Description
Use the arp anti-attack active-ack enable command to enable the ARP active acknowledgement function.
Use the undo arp anti-attack active-ack enable command to restore the default.
By default, the ARP active acknowledgement function is disabled.
Typically, this feature is configured on gateway devices to identify invalid ARP packets.
Examples
# Enable the ARP active acknowledgement function.
<Sysname> system-view
[Sysname] arp anti-attack active-ack enable
Syntax
arp anti-attack source-mac { filter | monitor }
undo arp anti-attack source-mac [ filter | monitor ]
View
System view
Default Level
2: System level
Parameters
filter: Specifies the filter mode.
monitor: Specifies the monitor mode.
Description
Use the arp anti-attack source-mac command to enable source MAC address based ARP attack detection and specify the detection mode.
Use the undo arp anti-attack source-mac command to restore the default.
By default, source MAC address based ARP attack detection is disabled.
After you enable this feature, the device checks the source MAC address of ARP packets received from the VLAN. If the number of ARP packets received from a source MAC address within five seconds exceeds the specified threshold:
l In filter detection mode, the device displays an alarm and filters out the ARP packets from the MAC address.
l In monitor detection mode, the device only displays an alarm.
Note that: If no detection mode is specified in the undo arp anti-attack source-mac command, both detection modes are disabled.
Examples
# Enable filter-mode source MAC address based ARP attack detection
<Sysname> system-view
[Sysname] arp anti-attack source-mac filter
Syntax
arp anti-attack source-mac aging-time time
undo arp anti-attack source-mac aging-time
View
System view
Default Level
2: System level
Parameters
time: Aging timer for protected MAC addresses, in the range of 60 to 6000 seconds.
Description
Use the arp anti-attack source-mac aging-time command to configure the aging timer for protected MAC addresses.
Use the undo arp anti-attack source-mac aging-time command to restore the default.
By default, the aging timer for protected MAC addresses is 300 seconds (five minutes).
Examples
# Configure the aging timer for protected MAC addresses as 60 seconds.
<Sysname> system-view
[Sysname] arp anti-attack source-mac aging-time 60
Syntax
arp anti-attack source-mac exclude-mac mac-address&<1-10>
undo arp anti-attack source-mac exclude-mac [ mac-address&<1-10> ]
View
System view
Default Level
2: System level
Parameters
mac-address&<1-10>: MAC address list. The mac-address argument indicates a protected MAC address in the format H-H-H. &<1-10> means you can specify up to ten protected MAC addresses in one command line.
Description
Use the arp anti-attack source-mac exclude-mac command to configure protected MAC addresses which will be excluded from ARP packet detection.
Use the undo arp anti-attack source-mac exclude-mac command to remove the configured protected MAC addresses.
By default, no protected MAC address is configured.
Note that: If no MAC address is specified in the undo arp anti-attack source-mac exclude-mac command, all the configured protected MAC addresses are removed.
Examples
# Configure a protected MAC address.
<Sysname> system-view
[Sysname] arp anti-attack source-mac exclude-mac 2-2-2
Syntax
arp anti-attack source-mac threshold threshold-value
undo arp anti-attack source-mac threshold
View
System view
Default Level
2: System level
Parameters
threshold-value: Threshold for source MAC address based ARP attack detection, in the range 10 to 100
Description
Use the arp anti-attack source-mac threshold command to configure the threshold for source MAC address based ARP attack detection. If the number of ARP packets sent from a MAC address within five seconds exceeds this threshold, the device considers this an attack.
Use the undo arp anti-attack source-mac threshold command to restore the default.
By default, the threshold for source MAC address based ARP attack detection is 50.
Examples
# Configure the threshold for source MAC address based ARP attack detection as 30.
<Sysname> system-view
[Sysname] arp anti-attack source-mac threshold 30
Syntax
display arp anti-attack source-mac [ interface interface-type interface-number ]
View
Any view
Default Level
1: Monitor level
Parameters
interface interface-type interface-number: Displays attacking MAC addresses detected on the interface.
Description
Use the display arp anti-attack source-mac command to display attacking MAC addresses detected by source MAC address based ARP attack detection.
Examples
# Display the attacking MAC addresses detected by source MAC address based ARP attack detection.
<Sysname> display arp anti-attack source-mac
Source-MAC VLAN ID Interface Aging-time
23f3-1122-3344 4094 GE1/0/1 10
23f3-1122-3355 4094 GE1/0/2 30
23f3-1122-33ff 4094 GE1/0/3 25
23f3-1122-33ad 4094 GE1/0/4 30
23f3-1122-33ce 4094 GE1/0/5 2
Syntax
arp anti-attack valid-check enable
undo arp anti-attack valid-check enable
View
System view
Default Level
2: System level
Parameters
None
Description
Use the arp anti-attack valid-check enable command to enable ARP packet source MAC address consistency check on the gateway. After you execute this command, the gateway device can filter out ARP packets with the source MAC address in the Ethernet header different from the sender MAC address in the ARP message.
Use the undo arp anti-attack valid-check enable command to disable ARP packet source MAC address consistency check.
By default, ARP packet source MAC address consistency check is disabled.
Examples
# Enable ARP packet source MAC address consistency check.
<Sysname> system-view
[Sysname] arp anti-attack valid-check enable
Syntax
arp rate-limit { disable | rate pps drop }
undo arp rate-limit
View
Layer-2 Ethernet interface view
Default Level
2: System level
Parameters
disable: Disables ARP packet rate limit.
rate pps: ARP packet rate in pps. in the range 5 to 100.
drop: Discards the exceeded packets.
Description
Use the arp rate-limit command to configure or disable ARP packet rate limit on an interface.
Use the undo arp rate-limit command to restore the default.
By default, ARP packet rate limit is disabled.
Examples
# Specify the ARP packet rate on GigabitEthernet1/0/1 as 50 pps, and exceeded packets will be discarded.
<Sysname> system-view
[Sysname] interface GigabitEthernet 1/0/1
[Sysname-GigabitEthernet1/0/1] arp rate-limit rate 50 drop
Syntax
arp detection enable
undo arp detection enable
View
VLAN view
Default Level
2: System level
Parameters
None
Description
Use the arp detection enable command to enable ARP detection for the VLAN.
Use the undo arp detection enable command to disable ARP detection for the VLAN.
By default, ARP detection is disabled for a VLAN.
Examples
# Enable ARP detection for VLAN 1.
<Sysname> system-view
[Sysname] vlan 1
[Sysname-Vlan1] arp detection enable
Syntax
arp detection mode { dhcp-snooping | static-bind }
undo arp detection mode { dhcp-snooping | static-bind }
View
System view
Default Level
2: System level
Parameters
dhcp-snooping: Implements ARP attack detection based on DHCP snooping entries. This mode is mainly used to prevent source address spoofing attacks.
static-bind: Implements ARP attack detection based on static IP-to-MAC binding entries. This mode is mainly used to prevent gateway spoofing attacks.
Description
Use the arp detection mode command to specify an ARP attack detection mode.
Use the undo arp detection mode command to cancel the specified ARP detection mode.
By default, no ARP detection mode is specified, that is, all packets are considered to be invalid.
Examples
# Enable ARP detection based on both DHCP snooping entries.
<Sysname> system-view
[Sysname] arp detection mode dhcp-snooping
Syntax
arp detection static-bind ip-address mac-address
undo arp detection static-bind [ ip-address ]
View
System view
Default Level
2: System level
Parameters
ip-address: IP address of the static binding.
mac-address: MAC address of the static binding, in the format of H-H-H.
Description
Use the arp detection static-bind command to configure a static IP-to-MAC binding.
Use the undo arp detection static-bind command to remove the configure static binding.
By default, no static IP-to-MAC binding is configured.
With ARP detection based on static IP-to-MAC bindings configured, the device, upon receiving an ARP packet from an ARP trusted/untrusted port, compares the source IP and MAC addresses of the ARP packet against the static IP-to-MAC bindings.
l If an entry with a matching IP address but different MAC address is found, the ARP packet is considered invalid and discarded.
l If an entry with both matching IP and MAC addresses is found, the ARP packet is considered valid and can pass the detection.
l If no match is found, the ARP packet is considered valid and can pass the detection.
Note that: If no IP address is specified in the undo arp detection static-bind command, all configured static IP-to-MAC bindings are removed.
Examples
# Configure a static IP-to-MAC binding.
<Sysname> system-view
[Sysname] arp detection static-bind 192.168.1.2 2-1-201
Syntax
arp detection trust
undo arp detection trust
View
Layer 2 Ethernet port view
Default Level
2: System level
Parameters
None
Description
Use the arp detection trust command to configure the port as an ARP trusted port.
Use the undo arp detection trust command to configure the port as an ARP untrusted port.
By default, the port is an ARP untrusted port.
Examples
# Configure gigabitethernet 1/0/1 as an ARP trusted port.
<Sysname> system-view
[Sysname] interface gigabitethernet 1/0/1
[Sysname-gigabitethernet1/0/1] arp detection trust
Syntax
arp detection validate { dst-mac | ip | src-mac } *
undo arp detection validate [ dst-mac | ip | src-mac ] *
View
System view
Default Level
2: System level
Parameters
dst-mac: Checks the target MAC address of ARP responses. If the target MAC address is all-zero, all-one, or inconsistent with the destination MAC address in the Ethernet header, the packet is considered invalid and discarded.
ip: Checks the source and destination IP addresses of ARP packets. The all-zero, all-one or multicast IP addresses are considered invalid and the corresponding packets are discarded. With this keyword specified, the source and destination IP addresses of ARP replies, and the source IP address of ARP requests will be checked.
src-mac: Checks whether the source MAC address of an ARP packet is identical to that in its Ethernet header. If they are identical, the packet is considered valid; otherwise, the packet is discarded.
Description
Use the arp detection validate command to configure ARP detection based on specified objects. You can specify one or more objects in one command line.
Use the undo arp detection validate command to remove detected objects. If no keyword is specified, all the detected objects are removed.
By default, ARP detection based on specified objects is disabled.
Examples
# Enable the checking of the MAC addresses and IP addresses of ARP packets.
<Sysname> system-view
[Sysname] arp detection validate dst-mac src-mac ip
Syntax
display arp detection
View
Any view
Default Level
1: Monitor level
Parameters
None
Description
Use the display arp detection command to display the VLAN(s) enabled with ARP detection.
Related commands: arp detection enable.
Examples
# Display the VLANs enabled with ARP detection.
<Sysname> display arp detection
ARP detection is enabled in the following VLANs:
1, 2, 4-5
Table 2-2 display arp detection command output description
|
Field |
Description |
|
ARP detection is enabled in the following VLANs |
VLANs that are enabled with ARP detection |
Syntax
display arp detection statistics [ interface interface-type interface-number ]
View
Any view
Default Level
1: Monitor level
Parameters
interface interface-type interface-number: Displays the ARP detection statistics of a specified interface.
Description
Use the display arp detection statistics command to display statistics about ARP detection. This command only displays numbers of discarded packets. If no interface is specified, the statistics of all the interfaces will be displayed.
Examples
# Display the ARP detection statistics of all the interfaces.
<Sysname> display arp detection statistics
State: U-Untrusted T-Trusted
ARP packets dropped by ARP inspect checking:
Interface(State) IP Src-MAC Dst-MAC Inspect
BAGG25(U) 0 0 0 0
GE1/0/1(T) 0 0 0 0
GE1/0/2(U) 0 0 0 0
GE1/0/3(U) 0 0 0 0
Table 2-3 display arp detection statistics command output description
|
Field |
Description |
|
Interface(State) |
State T or U identifies a trusted or untrusted port. |
|
IP |
Number of ARP packets discarded due to invalid source and destination IP addresses |
|
Src-MAC |
Number of ARP packets discarded due to invalid source MAC address |
|
Dst-MAC |
Number of ARP packets discarded due to invalid destination MAC address |
|
Inspect |
Number of ARP packets that failed to pass ARP detection (based on DHCP snooping entries/static IP-to-MAC bindings) |
Syntax
reset arp detection statistics [ interface interface-type interface-number ]
View
User view
Default Level
2: System level
Parameters
interface interface-type interface-number: Clears the ARP detection statistics of a specified interface.
Description
Use the reset arp detection statistics command to clear ARP detection statistics of a specified interface. If no interface is specified, the statistics of all the interfaces will be cleared.
Examples
# Clear the ARP detection statistics of all the interfaces.
<Sysname> reset arp detection statistics
