Dell MX9116n EMC SmartFabric OS10 User Guide - Page 201

• Use the following command in EXEC mode: show ip arp inspection statistics vlan vlan-name Example for viewing DAI statistics OS10# show ip arp inspection statistics Dynamic ARP Inspection (DAI) Statistics Valid ARP Requests Valid ARP Replies Invalid ARP Requests Invalid ARP Replies • View DAI violation information : 0 : 1000 : 1000 : 0 show ip arp inspection logging Example for viewing DAI violation information OS10# show ip arp inspection logging Total Number of Clients : 1 New Clients learnt in current Interval : 0 Invalid ARP packets in current interval : 0 Address Hw-Address Port VLAN First-detected-time Packet- count 10.1.1.1 12:d3:43:a1:2e:23 ethernet1/1/1 10 00:23:14 2 Source Address Validation Source Address Validation (SAV) is a security feature which instructs switches to permit IP traffic only from clients present in the DHCP snooping binding table. When you enable SAV, the switch compares the source IP and MAC addresses in the packet with the DHCP snooping binding table. If there is a match, the device forwards the packet. If there is no match, it drops the packet. SAV is disabled by default. NOTE: Dell EMC Networking recommends enabling SAV before enabling DHCP snooping on the system. OS10 supports three types of Source Address Validation: 1. Source IP address validation 2. Source IP and MAC address validation 3. DHCP source MAC address validation Source IP address validation This feature filters IP traffic, based on the source IP address and permits traffic only from clients present in the DHCP snooping binding table. The switch compares the following in the packet to the DHCP snooping binding table: • Source IP address • The VLAN to which the client is connected • The interface (physical or port channel) to which the client is connected If there is a match, the switch forwards the packet. Source IP and MAC address validation This feature filters IP traffic, based on both source IP and source MAC addresses and permits traffic only from clients found in the DHCP snooping binding table. The switch compares the following in the packet to the DHCP snooping binding table: • Source MAC address • Source IP address • The VLAN to which the client is connected • The interface (physical or port channel) to which the client is connected If there is a match, the switch forwards the packet. System management 201