21To do… Use the command… Remarks1. Enter system view system-view —2. Enter Ethernet interfaceviewinterface interface-type interface-number —3. Configure ARP packetrate limitarp rate-limit { disable | ratepps drop }RequiredBy default, the ARP packet rate limit is notenabledConfiguring ARP detection• For information about DHCP snooping, refer to DHCP Configuration.• For information about 802.1X, refer to 802.1X Configuration.Introduction to ARP detectionThe ARP detection feature allows only the ARP packets of authorized clients to be forwarded, preventingman-in-the-middle attacks.Man-in-the-middle attackAccording to ARP design, after receiving an ARP reply, a host adds the IP-to-MAC mapping of the senderto its ARP mapping table. This design reduces ARP traffic on the network, but also makes ARP spoofingpossible.Man-in-the-middle attack process1. As shown in Figure 4, Host A communicates with Host C through a switch.2. After intercepting the traffic between Host A and Host C, a hacker (Host B) forwards forged ARPreplies to Host A and Host C respectively.3. Upon receiving the ARP replies, the two hosts update the MAC address corresponding to the peerIP address in their ARP tables with the MAC address of Host B (MAC_B).4. After that, Host B establishes independent connections with Host A and Host C5. Host B relays messages between Host A and Host C, deceiving them into believing that they aretalking directly to each other over a private connection. Host B controls the entire conversation, andcan intercept and modify the communication data.
