216Step Command Remarks2. Enable source MAC-basedARP attack detection andspecify the handling method.arp source-mac { filter | monitor } By default, this feature is disabled.3. Configure the threshold. arp source-mac thresholdthreshold-value By default, the threshold is 30.4. Configure the aging timer forARP attack entries. arp source-mac aging-time time By default, the lifetime is 300seconds.5. (Optional.) Exclude specifiedMAC addresses from thisdetection.arp source-mac exclude-macmac-address&<1-10>By default, no MAC address isexcluded.NOTE:When an ARP attack entry expires, ARP packets sourced from the MAC address in the entry can beprocessed normally.Displaying and maintaining source MAC-based ARP attackdetectionExecute display commands in any view.Task CommandDisplay ARP attack entries detected by sourceMAC-based ARP attack detection.display arp source-mac { slot slot-number | interfaceinterface-type interface-number }Configuration exampleNetwork requirementsAs shown in Figure 69, the hosts access the Internet through a gateway (Device). If malicious users senda large number of ARP requests to the gateway, the gateway may crash and cannot process requestsfrom the clients. To solve this problem, configure source MAC-based ARP attack detection on thegateway.
