1-37receives 200 TC-BPDUs in the period, the switch removes the MAC address table and ARP entries foronly 100 times within the period.Configuration prerequisitesMSTP runs normally on the switch.Configuration procedureFollow these steps to configure the TC-BPDU attack guard function:To do... Use the command... RemarksEnter system view system-view —Enable the TC-BPDU attack guardfunction stp tc-protection enableRequiredThe TC-BPDU attack guardfunction is disabled by default.Set the maximum times that aswitch can remove the MACaddress table and ARP entrieswithin each 10 secondsstp tc-protection thresholdnumber OptionalConfiguration example# Enable the TC-BPDU attack guard function system-view[Sysname] stp tc-protection enable# Set the maximum times for the switch to remove the MAC address table and ARP entries within 10seconds to 5. system-view[Sysname] stp tc-protection threshold 5Configuring BPDU DroppingIn a STP-enabled network, some users may send BPDU packets to the switch continuously in order todestroy the network. When a switch receives the BPDU packets, it will forward them to other switches.As a result, STP calculation is performed repeatedly, which may occupy too much CPU of the switchesor cause errors in the protocol state of the BPDU packets.In order to avoid this problem, you can enable BPDU dropping on Ethernet ports. Once the function isenabled on a port, the port will not receive or forward any BPDU packets. In this way, the switch isprotected against the BPDU packet attacks so that the STP calculation is assured to be right.Configuration PrerequisitesMSTP runs normally on the switch.Configuration procedureFollow these steps to configure BPDU dropping:To do... Use the command... RemarksEnter system view system-view —Enter Ethernet port view interface interface-name —Enable BPDU dropping bpdu-drop any RequiredBPDU dropping is disabled by default.
