arp inspection burst interval

[KasperK]

Hi every one

I'm fine tuning the limit rate on arp inspection, but I itch in my head over the correct understanding of arp inspection burst interval. In fact, another person has asked the very same question https://www.mail-archive.com/ccie_security@onlinestudylist.com/msg00909.html (a long time ago) but lacks some answers:

quoted:

I've been looking at the documentation, but can't seem so figure out how
the burst interval setting works. Can anyone enlighten me?

Does it:

1 - set the number of seconds that the limit must exceed to put the port
into err-disable?

So - ip arp inspection limit rate 15 burst interval 5 will cause
err-disable if 15 arps are seen over a 5 second window.

Or

2 - set to total number of consecutive seconds that the limit must
exceed to put the port into err-disable?

So - ip arp inspection limit rate 15 burst interval 5 will cause
err-disable if 15 arps are seen over a 1 second window for 5 consecutive
seconds.

[Kasun Bandara · Accepted solution]

Hi, as per the doc. it is seconds .

ip arp inspection limit

ip arp inspection limit

Use the ip arp inspection limit interface configuration command on the switch stack or on a standalone

switch to limit the rate of incoming Address Resolution Protocol (ARP) requests and responses on an

interface. It prevents dynamic ARP inspection from using all of the switch resources if a

denial-of-service attack occurs. Use the no form of this command to return to the default settings.

1. ip arp inspection limit {rate pps [burst interval seconds] | none}
2. no ip arp inspection limit

Syntax Description

rate pps - Specify an upper limit for the number of incoming packets processed per second. The range is 0 to 2048 packets per second (pps).

burst interval seconds - (Optional) Specify the consecutive interval in seconds, over which the interface is monitored for a high rate of ARP packets. The range is 1 to 15 seconds.

none - Specify no upper limit for the rate of incoming ARP packets that can be processed.

Defaults

The rate is 15 pps on untrusted interfaces, assuming that the network is a switched network with a host connecting to as many as 15 new hosts per second.

The rate is unlimited on all trusted interfaces.

The burst interval is 1 second.

rate this and mark as answer if this resolved your concern