Identifying blacklisted and restored clients

The switch event log records an entry when ip arp-throttle blacklists a client, removes a client from the blacklist, or drops an ARP packet received from a blacklisted client. Use the show logging command to display entries for these actions.

Example

switch# show logging -r

 Keys:   W=Warning   I=Information
         M=Major     D=Debug E=Error

----  Reverse event Log listing: Events Since Boot  ----

W 02/16/16 22:57:16 02539 arpt: ST1-CMDR: Client 20fdf1-e0935b exceeds the limit of ARP packets and is blacklisted.

W 02/16/16 22:57:16 02541 arpt: ST1-CMDR: An ARP packet from blacklist client 20fdf1-e0935b is dropped. (4 times in 60 seconds)

W 02/16/16 22:57:03 02539 arpt: ST1-CMDR: Client d0bf9c-13c149 exceeds the limit of ARP packets and is blacklisted.

I 02/16/16 21:52:05 02540 arpt: ST1-CMDR: Client 20fdf1-e0935b is moved out of blacklist due to inactivity.