Quick Solution to ARP virus on Cisco and H3C exchange Devices

Cisco switches:

1. show logging on the central switch and find the following logs:
Apr 18 10:24:16. 265: % IP-4-DUPADDR: Duplicate address 172.30.30.62 on Vlan711, sourced by 0009.6b84.189e; indicates there is ARP virus,
2. Run conf t and mac-address static mac address vlan id drop;
3. The host with ARP virus is processed and then executed on the central switch.
No mac-address static mac address vlan id drop, enabling the host to access network resources.
4. Problem Solving

 
 
H3C switch:
Dis log found the following information:
% Apr 30 07: 43: 18: 753 2000 Longjing ARP/3/DUPIFIP: Duplicate address 192.168.1.1 o
N interface Vlan-interface101, sourced by 001b-b970-266d
<Longjing> dis mac-address 0016-e67c-7c9f
It is found that the mac is from g1/0/4.

Enter this interface:
Interface GigabitEthernet1/0/4
Mac-address blackhole 001b-b970-266d vlan 101
Find the machine, remove the network cable, and then cancel the limits under this interface.
Interface GigabitEthernet1/0/4
Undo mac-address blackhole 001b-b970-266d vlan 101