D-Link DGS-3426P Product Manual - Page 320

xStack® DGS-3400 Series Layer 2 Gigabit Ethernet Managed Switch The following parameters can be configured: Parameter Description Global State Enable or disable the BPDU attack protection global state. Trap State Enable or disable the BPDU attack trap state. Log State Enable or disable the BPDU attack log state. Recover Time (60-1000000) Enter the BPDU protection Auto-Recovery recovery timer. The default value is 60. If Infinite is ticked, the port will not be auto recovered. Unit Select the unit to be configured. From/To State Mode Select the port or range of ports to be configured. Enable or disable BPDU attack protection for the specified individual ports. Select the BPDU attack protection mode: Drop, Block, or Shutdown. Drop - Drop all received BPDU packets when the port enters under_attack state. Block - Drop all packets (include BPDU and normal packets) when the port enters the under attack state. Shutdown - Shut down the port when the port enters the under attack state. Click Apply to implement the changes. ARP Spoofing Prevention Settings ARP spoofing, also known as ARP poisoning, is a method to attack an Ethernet network which may allow an attacker to sniff data frames on a LAN, modify the traffic, or stop the traffic altogether (known as a Denial of Service - DoS attack). The principle of ARP spoofing is to send fake or spoofed ARP messages to an Ethernet network. Generally, the aim is to associate the attacker's or a random MAC address with the IP address of another node (such as the default gateway). Any traffic meant for that IP address would be mistakenly re-directed to the node specified by the attacker. To prevent an ARP spoofing attack, Packet Content ACL is used to block the invalid ARP packets which contain a faked gateway's MAC and IP binding. Packet Content ACL can inspect any specified content in the first 48 bytes of a packet. It utilizes offsets to match individual fields in the Ethernet frame. An offset contains 16 bytes and each offset is divided into four 4-byte values in HEX format. The configuration logic is as follows: • The traffic can only pass through the Switch if the ARP entry matches a source MAC address in the Ethernet frame, the sender MAC address, or the sender IP address in the ARP protocol. • The Switch will deny all other ARP packets which claim they are from the gateway's IP. To view this window, click Security > ARP Spoofing Prevention Settings, as shown below. Figure 6 - 41 ARP Spoofing Prevention Settings window The following parameters can be configured: 311