User's Manual

Configuration Guide of XGS-5240-Series
32-1
Chapter 32 ARP Scanning Prevention
Function Configuration
32.1 Introduction to ARP Scanning Prevention
Function
ARP scanning is a common method of network attack. In order to detect all the active
hosts in a network segment, the attack source will broadcast lots of ARP messages in the
segment, which will take up a large part of the bandwidth of the network. It might even do
large-traffic-attack in the network via fake ARP messages to collapse of the network by
exhausting the bandwidth. Usually ARP scanning is just a preface of other more dangerous
attack methods, such as automatic virus infection or the ensuing port scanning, vulnerability
scanning aiming at stealing information, distorted message attack, and DOS attack, etc.
Since ARP scanning threatens the security and stability of the network with great danger,
so it is very significant to prevent it. Switch provides a complete resolution to prevent ARP
scanning: if there is any host or port with ARP scanning features is found in the segment, the
switch will cut off the attack source to ensure the security of the network.
There are two methods to prevent ARP scanning: port-based and IP-based. The
port-based ARP scanning will count the number to ARP messages received from a port in a
certain time range, if the number is larger than a preset threshold, this port will be “down”. The
IP-based ARP scanning rate-limiting and isolate two levels threshold, when it above level-1
threshold (the limited threshold), the hardware transmits the ARP packet (including ARP
request and reply) of this host normally, and only limit the CPU rate. And produce trap warning
to notify administrator that there may be attacked; when packets rate is level-2 threshold
(isolation threshold), it will take action, record log and produce trap warning. The level-1 limited
threshold and level-2 isolate threshold will be open when enable IP-based ARP scanning in
global mode, level-1 threshold will take effect until it lower than level-2 threshold. The two kind
of ARP scanning prevention can be start using at the same time, after port is banned, it can
recover the state by configure the function of automatic recovery. After IP is banned, it can be
automatic recovery when the rate of received arp packets is lower than level-2 threshold.
To improve the effect of the switch, users can configure trusted ports and IP, the ARP
messages from which will not be checked by the switch. Thus the load of the switch can be
effectively decreased.