Dynamic ARP Inspection (DAI) rate limiting protects switch CPU resources from ARP floods that could cause denial of service. It limits ARP messages received on each port. section 14.2.3
Configure and manage the limit per interface:
- Untrusted ports default to 15 packets per second; trusted ports have no rate limit. section 14.2.3
- Use ip arp inspection limit rate rate [burst interval seconds]. The default burst interval is 1 second. section 14.2.3
- A rate of 40 with burst interval 2 permits 40 packets every 2 seconds, allowing larger bursts than 20 packets per second. section 14.2.3
- Exceeding the limit error-disables the port; restore it with shutdown followed by no shutdown, or enable errdisable recovery cause arp-inspection. section 14.2.3
A rate violation
On interface G0/2, ip arp inspection limit rate 1 permits one packet per second. Receiving two packets within 559 milliseconds triggers a rate-exceeded message and places the interface in err-disabled state.
