SNR S2989G-48TX [181/553] Arp scanning prevention

S2989G-24TX Operation Manual

Chapter 3 IP services Configuration

3-19

3.7

ARP Scanning Prevention

3.7.1

Introduction to ARP Scanning Prevention

Function

ARP scanning is a common method of network attack. In order to detect all the active

hosts in a network segment, the attack source will broadcast lots of ARP messages in the

segment, which will take up a large part of the bandwidth of the network. It might even do

large-traffic-attack in the network via fake ARP messages to collapse of the network by

exhausting the bandwidth. Usually ARP scanning is just a preface of other more

dangerous attack methods, such as automatic virus infection or the ensuing port scanning,

vulnerability scanning aiming at stealing information, distorted message attack, and DOS

attack, etc.

Since ARP scanning threatens the security and stability of the network with great

danger, so it is very significant to prevent it. Switch provides a complete resolution to

prevent ARP scanning: if there is any host or port with ARP scanning features is found in

the segment, the switch will cut off the attack source to ensure the security of the network.

There are two methods to prevent ARP scanning: port-based and IP-based. The port-

based ARP scanning will count the number to ARP messages received from a port in a

certain time range, if the number is larger than a preset threshold, this port will be

“down”. The IP-based ARP scanning rate-limiting and isolate two levels threshold, when it

above level-1 threshold (the limited threshold), the hardware transmits the ARP packet

(including ARP request and reply) of this host normally, and only limit the CPU rate. And

produce trap warning to notify administrator that there may be attacked; when packets

rate is level-2 threshold (isolation threshold), it will take action, record log and produce

trap warning. The level-1 limited threshold and level-2 isolate threshold will be open when

enable IP-based ARP scanning in global mode, level-1 threshold will take effect until it

lower than level-2 threshold. The two kind of ARP scanning prevention can be start using

at the same time, after port is banned, it can recover the state by configure the function of

automatic recovery. After IP is banned, it can be automatic recovery when the rate of

received arp packets is lower than level-2 threshold.

To improve the effect of the switch, users can configure trusted ports and IP, the ARP

messages from which will not be checked by the switch. Thus the load of the switch can

be effectively decreased.