deception mac-address aging-time

Function

The deception mac-address aging-time command configures the interval at which the switch sends an ARP broadcast packet.

The undo deception mac-address aging-time command restores the default interval at which the switch sends an ARP broadcast packet.

By default, the switch sends an ARP broadcast packet at an interval of 290 seconds.

Format

deception mac-address aging-time aging-time

undo deception mac-address aging-time

Parameters

Parameter	Description	Value
aging-time	Specifies the interval at which the switch sends an ARP broadcast packet.	The value is an integer in the range from 10 to 1000000, in seconds.

Views

Deception view

Default Level

2: Configuration level

Usage Guidelines

To perform spoofing on IP address scanning, the switch constructs a virtual MAC address and sends it to the scanning source. The scanning source then incorrectly considers that the IP address to be scanned is online, and the switch diverts subsequent traffic from the scanning source to a Decoy for attack detection. The Layer 2 switch records an ARP entry of the scanned IP address and virtual MAC address. To prevent packets destined for the scanned IP address from being broadcast on the network after the entry is aged out, the switch periodically sends an ARP broadcast packet that contains the mapping between the scanned IP address and the virtual MAC address to the Layer 2 switch. You can run the deception mac-address aging-time command to adjust the interval at which the switch sends an ARP broadcast packet.

Example

# Set the interval at which the switch sends an ARP broadcast packet to 300 seconds.

<HUAWEI> system-view
[HUAWEI] deception
[HUAWEI-deception] deception mac-address aging-time 300