Cisco switches:
Show logging found the following log on the central switch
APR 10:24:16.265:%ip-4-dupaddr:duplicate address 172.30.30.62 in Vlan711, sourced by 0009.6b84.189e; description has ARP virus,
2, the implementation of Conf t,mac-address static MAC address VLAN ID drop;
3, the host has the ARP virus processing, and then on the central switch execution
No mac-address static MAC address VLAN ID drop, which enables the host to access network resources.
4. Problem solving
H3C Switch:
Dis Log found the following information:
%APR 07:43:18:753 longjing arp/3/dupifip:duplicate address 192.168.1.1 o
N interface vlan-interface101, sourced by 001b-b970-266d
<longjing>dis mac-address 0016-e67c-7c9f
Found out that the Mac came from G1/0/4.
Enter this interface:
Interface GIGABITETHERNET1/0/4
Mac-address blackhole 001b-b970-266d VLAN 101
Then find the machine to remove the network cable antivirus, and then cancel the restrictions under the interface
Interface GIGABITETHERNET1/0/4
Undo Mac-address Blackhole 001b-b970-266d VLAN 101