Arp Poisoning - Alcatel-Lucent OmniSwitch 6850-48 Network Configuration Manual

Configuring IP
Setting the Port Scan Penalty Value Threshold
The port scan penalty value threshold is the highest point the total penalty value for the switch can reach
before a trap is generated informing the administrator that a port scan is in progress.
To set the port scan penalty value threshold, enter the threshold value with the
command. For example, to set the port scan penalty value threshold to 2000, enter the following:
-> ip dos scan threshold 2000
Setting the Decay Value
The decay value is the amount the total penalty value is divided by every minute. As the switch records
incoming UDP and TCP packets, it adds their assigned penalty values together to create the total penalty
value for the switch. To prevent the switch from registering a port scan from normal traffic, the decay
value is set to lower the total penalty value every minute to compensate from normal traffic flow.
To set the decay value, enter the decay value with the
the decay value to 2, enter the following:
-> ip dos scan decay 2
Enabling DoS Traps
DoS traps must be enabled in order for the switch to warn the administrator that a port scan may be in
progress when the switch's total penalty value crosses the port scan penalty value threshold.
To enable SNMP trap generation, enter the
-> ip dos trap enable
To disable DoS traps, enter the same
-> ip dos trap disable

ARP Poisoning

ARP Poisoning allows an attacker to sniff and tamper the data frames on a network. It also modifies or
halts the traffic. The principle of ARP Poisoning is to send false or spoofed ARP messages to an Ethernet
LAN.
Alcatel-Lucent introduces the functionality that detects the presence of an ARP poisoning host on a
network. This functionality uses a configured restricted IP addresses, so that the switch will not get ARP
response on sending an ARP request. If an ARP response is received, then an event is logged and the user
is alerted using an SNMP trap.
Use the ip dos arp-poison restricted-address
the command, followed by the IP address. For example, to add an ARP Poison restricted address as
192.168.1.1, you would enter:
-> ip dos arp-poison restricted-address 192.168.1.1
A maximum of two IP addresses per IP interface can be configured as restricted addresses.
To delete an ARP Poison restricted address, enter no ip dos arp-poison restricted-address followed by
the IP address. For example:
-> no ip dos arp-poison restricted-address 192.168.1.1
OmniSwitch AOS Release 6 Network Configuration Guide
ip dos scan decay
ip dos trap command, as shown:
ip dos trap command, as shown:
command to add an ARP Poison restricted address. Enter
September 2009
IP Configuration
ip dos scan threshold
command. For example, to set
page 24-27