D-Link DES-1210-10/ME [73/129] Security safeguard engine

4 Configuration DES-1210 Metro Ethernet Managed Switch User Manual

172.17.5.215

255.0.0.0

172.0.0.1~172.255.255.255

To delete the IP address, simply click the Delete button. Check the unwanted address, and then click Apply.

Security > Safeguard Engine

D-Link’s Safeguard Engine is a robust and innovative technology that automatically throttles the impact of

packet flooding into the switch's CPU. This function helps protect the Switch from being interrupted by

malicious viruses or worm attacks. This option is enabled by default.

Figure 4.113 – Security > Safeguard Engine

Security > ARP Spoofing Prevention

ARP spoofing, also known as ARP poisoning, is a method to attack an Ethernet network by allowing an

attacker to sniff data frames on a LAN, modifying the traffic, or stopping the traffic (known as a Denial of

Service – DoS attack). The main idea of ARP spoofing is to send fake or spoofed ARP messages to an

Ethernet network. It associates the attacker's or random MAC address with the IP address of another node

such as the default gateway. Any traffic meant for that IP address would be mistakenly re-directed to the

node specified by the attacker.

A common DoS attack today can be done by associating a nonexistent or specified MAC address to the IP

address of the network’s default gateway. The malicious attacker only needs to broadcast one gratuitous

ARP to the network claiming to be the gateway, so that the whole network operation is turned down as all

packets to the Internet will be directed to the wrong node.

The ARP Spoofing Prevention function can discard the ARP Spoofing Attack in the network by checking the

gratuitous ARP packets and filtering those with illegal IP or MAC addresses.

Figure 4.114 – Security > ARP Spoofing Prevention Setting

Enter the IP Address, MAC Address, Ports and then click Add to create a checking/filtering rule. Click

Delete to remove an existing rule and Delete All to clear all the entries.