arp anti-attack rate-limit enable

Function

The arp anti-attack rate-limit enable command enables rate limit on ARP packets.

The undo arp anti-attack rate-limit enable command disables rate limit on ARP packets.

By default, rate limiting on ARP packets is disabled.

Format

arp anti-attack rate-limit enable

undo arp anti-attack rate-limit enable

Parameters

None

Views

System view, VLAN view, Ethernet interface view, GE interface view, 40GE interface view, XGE interface view, 25GE interface view, 100GE interface view, MultiGE interface view, port group view, Eth-Trunk interface view

Default Level

2: Configuration level

Usage Guidelines

The device has no sufficient CPU resource to process other services when processing a large number of ARP packets. To protect CPU resources of the device, limit the rate of ARP packets.

You can run the arp anti-attack rate-limit enable command to enable rate limit on ARP packets. When the rate of ARP packets exceeds the limit, excess ARP packets are discarded. To set the rate limit and rate limiting duration of ARP packets, run the arp anti-attack rate-limit command.

After the optimized ARP reply function (disabled by default) is enabled using the undo arp optimized-reply disable command, rate limiting on ARP packets globally, in a VLAN, or on an Interface does not take effect.

Example

# Enable rate limit on ARP packets globally.

<HUAWEI> system-view
[HUAWEI] arp anti-attack rate-limit enable

# Enable rate limit for the ARP packets on Layer 2 interface GE0/0/1.

<HUAWEI> system-view
[HUAWEI] interface gigabitethernet 0/0/1
[HUAWEI-GigabitEthernet0/0/1] arp anti-attack rate-limit enable

# Enable rate limit for the ARP packets on Layer 3 interface GE0/0/1.

<HUAWEI> system-view
[HUAWEI] interface gigabitethernet 0/0/1
[HUAWEI-GigabitEthernet0/0/1] undo portswitch
[HUAWEI-GigabitEthernet0/0/1] arp anti-attack rate-limit enable