Catalyst 3750-E and 3560-E Switch Cisco IOS ... - DNIP . NET

Chapter 2Catalyst 3750-E and 3560-E Switch Cisco IOS Commandsip arp inspection limitip arp inspection limitUse the ip arp inspection limit interface configuration command on the switch stack or on a standaloneswitch to limit the rate of incoming Address Resolution Protocol (ARP) requests and responses on aninterface. It prevents dynamic ARP inspection from using all of the switch resources if adenial-of-service attack occurs. Use the no form of this command to return to the default settings.ip arp inspection limit {rate pps [burst interval seconds] | none}no ip arp inspection limitSyntax Descriptionrate ppsburst interval secondsnoneSpecify an upper limit for the number of incoming packets processed persecond. The range is 0 to 2048 packets per second (pps).(Optional) Specify the consecutive interval in seconds, over which theinterface is monitored for a high rate of ARP packets.The range is 1 to 15seconds.Specify no upper limit for the rate of incoming ARP packets that can beprocessed.DefaultsThe rate is 15 pps on untrusted interfaces, assuming that the network is a switched network with a hostconnecting to as many as 15 new hosts per second.The rate is unlimited on all trusted interfaces.The burst interval is 1 second.Command ModesInterface configurationCommand HistoryRelease12.2(35)SE2ModificationThis command was introduced.Usage GuidelinesThe rate applies to both trusted and untrusted interfaces. Configure appropriate rates on trunks to processpackets across multiple dynamic ARP inspection-enabled VLANs, or use the none keyword to make therate unlimited.After a switch receives more than the configured rate of packets every second consecutively over anumber of burst seconds, the interface is placed into an error-disabled state.Unless you explicitly configure a rate limit on an interface, changing the trust state of the interface alsochanges its rate limit to the default value for that trust state. After you configure the rate limit, theinterface retains the rate limit even when its trust state is changed. If you enter the no ip arp inspectionlimit interface configuration command, the interface reverts to its default rate limit.You should configure trunk ports with higher rates to reflect their aggregation. When the rate ofincoming packets exceeds the user-configured rate, the switch places the interface into an error-disabledstate. The error-disabled recovery feature automatically removes the port from the error-disabled stateaccording to the recovery setting.OL-9776-08Catalyst 3750-E and 3560-E Switch Command Reference2-217