1-38period, the switch may be busy in removing the MAC address table and ARP entries, which may affectspanning tree calculation, occupy large amount of bandwidth and increase switch CPU utilization.With the TC-BPDU attack guard function enabled, a switch performs a removing operation uponreceiving a TC-BPDU and triggers a timer (set to 10 seconds by default) at the same time. Before thetimer expires, the switch only performs the removing operation for limited times (up to six times bydefault) regardless of the number of the TC-BPDUs it receives. Such a mechanism prevents a switchfrom being busy in removing the MAC address table and ARP entries.You can use the stp tc-protection threshold command to set the maximum times for a switch toremove the MAC address table and ARP entries in a specific period. When the number of theTC-BPDUs received within a period is less than the maximum times, the switch performs a removingoperation upon receiving a TC-BPDU. After the number of the TC-BPDUs received reaches themaximum times, the switch stops performing the removing operation. For example, if you set themaximum times for a switch to remove the MAC address table and ARP entries to 100 and the switchreceives 200 TC-BPDUs in the period, the switch removes the MAC address table and ARP entries foronly 100 times within the period.Configuration prerequisitesMSTP runs normally on the switch.Configuration procedureFollow these steps to configure the TC-BPDU attack guard function:To do... Use the command... RemarksEnter system view system-view —Enable the TC-BPDU attackguard function stp tc-protection enableRequiredThe TC-BPDU attack guardfunction is disabled by default.Set the maximum times that aswitch can remove the MACaddress table and ARP entrieswithin each 10 secondsstp tc-protection thresholdnumber OptionalConfiguration example# Enable the TC-BPDU attack guard function system-view[Sysname] stp tc-protection enable# Set the maximum times for the switch to remove the MAC address table and ARP entries within 10seconds to 5. system-view[Sysname] stp tc-protection threshold 5Configuring BPDU DroppingIn a STP-enabled network, some users may send BPDU packets to the switch continuously in order todestroy the network. When a switch receives the BPDU packets, it will forward them to other switches.
