Configuring unresolvable IP attack protection

If a device receives from a host a large number of IP packets that cannot be resolved by ARP (called unresolvable IP packets), the following situations can occur:

• The device sends a large number of ARP requests, overloading the target subnets.

• The device keeps trying to resolve target IP addresses, overloading its CPU.

To protect the device from such IP packet attacks, you can configure the following features:

• ARP source suppression—If the attack packets have the same source address, you can enable the ARP source suppression function, and set the maximum number of unresolvable IP packets that a host can send within five seconds. If the threshold is reached, the device stops resolving packets from the host until the five seconds elapse.

• ARP black hole routing—You can enable the ARP black hole routing function regardless of whether the attack packets have the same source address. After receiving an unresolvable IP packet, the device creates a black hole route destined for that IP address and drops all the matching packets until the black hole route ages out.