How does the Display command of the core switch defend against ARP virus?

The core switch is still quite commonly used. So I studied how to use the Display command of the core switch to combat the ARP virus. Here I will share it with you and hope it will be useful to you. In a LAN environment, we often encounter failures where several computers in a working Subnet or all computers cannot access the Internet, after the working status of the switching port and bandwidth traffic exceptions are eliminated, an important factor that causes the above fault is the possibility of arp virus in the working subnet.

So which computer is infected with the ARP virus, resulting in slow or abnormal access speed of the entire virtual working subnet? If we conduct on-site troubleshooting for each computer according to the conventional method, the workload is obviously huge. In fact, we can use the displaymac command in the core switch system skillfully, we can quickly find out the source of the ARP virus. The following describes how to implement it:

First, find a common computer system that can access the core switch, and then click the "Start"/"program"/"attachment"/"communication"/"Super Terminal" command, establish a super terminal connection to the core switch, and enter the background management system of the core switch as a privileged identity. Execute the "sys" string command to switch the working mode of the core switch to the global configuration mode;

In this mode, enter the "displaydia" string command, click the "transfer"/"Capture text" menu option in the Super Terminal window, and set a save path, suppose we set the path to "C: \ aa.txt", and then click the Enter key. The core switch system will automatically scan all the optical fiber switching ports, the scan results are automatically saved to the "C: \ aa.txt" file;

After the scan is complete, use the Notepad program in the Local Computer System to open the "C: \ aa.txt" file, we can see that a specific mac address conflicts with the gateway address of the corresponding virtual working subnet, in this way, other computers in the working subnet will use an incorrect gateway address when accessing the Internet. In this case, they naturally cannot access the Internet normally.

Then, find a Layer 2 Switch Based on the Vlan number, log on to the background management system of the Target layer 2 core switch with a privileged account, and switch the system to the global configuration status, enter the "displaymac" string command at the command line prompt in this status. On the System screen, the result page shown in 3 is displayed, and the conflicting mac address is found, record the port numbers that should be recorded;

Once the specific switch port is located, we can find the computer to which the switch port is connected Based on the label number on the switch port, in this case, we can use the "shutdown" command to temporarily close the switch port, and then ask the target computer user to re-install the operating system or scan and kill the network virus. After removing the network virus or reinstalling the operating system, then we use the "undoshutdown" command on the target switch port to restore its working status to normal, so that the ARP network virus failure can be quickly ruled out.