Netgear XCM8806 Chassis User Manual - Page 459

NETGEAR 8800 User Manual • Destination MAC address-FF:FF:FF:FF:FF:FF (broadcast) • Source MAC address-Host's MAC address • Source IP address = Destination IP address-IP address to be resolved In a network, gratuitous ARP is used to: • Detect duplicate IP address In a properly configured network, there is no ARP reply for a gratuitous ARP request. However, if another host in the network is configured with the same IP address as the source host, then the source host receives an ARP reply. • Announce that an IP address has moved or bonded to a new network interface card (NIC) If you change a system NIC, the MAC address to its IP address mapping also changes. When you reboot the host, it sends an ARP request packet for its own IP address. All of the hosts in the network receive and process this packet. Each host updates their old mapping in the ARP table with this new mapping • Notify a Layer 2 switch that a host has moved from one port to another port However, hosts can launch man-in-the-middle attacks by sending out gratuitous ARP requests for the router's IP address. This results in hosts sending their router traffic to the attacker, and the attacker forwarding that data to the router. This allows passwords, keys, and other information to be intercepted. To protect against this type of attack, the router sends out its own gratuitous ARP request to override the attacker whenever a gratuitous ARP request broadcast packet with the router's IP address as the source is received on the network. If you enable both DHCP secured ARP and gratuitous ARP protection, the switch protects its own IP address and those of the hosts that appear as secure entries in the ARP table. Configuring Gratuitous ARP You enable the gratuitous ARP feature on a per VLAN basis, not on a per port basis. The validation is done for all gratuitous ARP packets received on a VLAN in which this feature is enabled irrespective of the port in which the packet is received. When enabled, the switch generates gratuitous ARP packets when it receives a gratuitous ARP request where either of the following is true: • The sender IP is the same as the switch VLAN IP address and the sender MAC address is not the switch MAC address. • The sender IP is the same as the IP of a static entry in the ARP table and the sender MAC address is not the static entry's MAC address. When the switch generates an ARP packet, the switch generates logs and traps. You can enable gratuitous ARP protection with the following command: enable ip-security arp gratuitous-protection {vlan} [all | ] Chapter 17. Security | 459