User Manual

Configure System Information
105
ProSAFE 10-Gigabit Smart Managed Switch XS708T and XS716T User Manual
6. Click Clear to clear all interfaces statistics.
The following table describes the DHCP snooping statistics.
Dynamic ARP Inspection
Dynamic ARP Inspection (DAI) is a security feature that rejects invalid and malicious ARP
packets. DAI prevents a class of man-in-the-middle attacks where an unfriendly station
intercepts traffic for other stations by poisoning the ARP caches of its unsuspecting
neighbors. The malicious attacker sends ARP requests or responses mapping another
station’s IP address to its own MAC address.
When DAI is enabled, the switch drops ARP packets whose sender MAC address and
sender IP address do not match an entry in the DHCP snooping bindings database. You can
optionally configure additional ARP packet validation.
When DAI is enabled on a VLAN, DAI is enabled on the interfaces (physical ports or LAGs)
that are members of that VLAN. Individual interfaces are configured as trusted or untrusted.
The trust configuration for DAI is independent of the trust configuration for DHCP snooping.
Configure DAI Globally
If you configure the source MAC address validation option, DAI verifies that the sender MAC
address in an ARP packet equals the source MAC address in the Ethernet header.
The Ethernet header includes a configurable option to verify that the target MAC address in
Table 27. DHCP Snooping Statistics information
Field Description
Interface The interface associated with the rest of the data in the row.
MAC Verify Failures The number of DHCP messages that were dropped because the source MAC address
and client hardware address did not match. MAC address verification is performed only if
it is globally enabled.
Client Ifc Mismatch The number of packets that were dropped by DHCP snooping because the interface and
VLAN on which the packet was received do not match the client’s interface and VLAN
information stored in the binding database.
DHCP Server Msgs
Received
The number of DHCP server messages ((DHCPOFFER, DHCPACK, DHCPNAK,
DHCPRELEASEQUERY) that were dropped on an untrusted port.