Quickly solve ARP virus problems through Cisco switch logs

If the network is too large and an ARP spoofing virus occasionally appears in the network, it will be troublesome. Therefore, if the switch in your network permits Vlan division, the finer the Vlan, the better. The smaller the network you divide, the smaller the broadcast range is.

 
So how can I check if there is an ARP virus on your network. First, we need to know that when the ARP virus is serious, all the computers in the network will not be able to communicate with all the networks outside the subnetwork. If there is occasional poor Internet access, consider whether the virus exists.
 
There are methods to check whether the virus is in progress. ArP blocking information is usually found through the arpfirewall, And the last layer of switch connecting to the computer. Log on to the vswitch and run the show logging command to view the vswitch logs. If the ARP virus exists, the vswitch displays the following logs.
00: 37: 11: % IP-4-DUPADDR: Duplicate address 172.16.60.254 on Vlan60, sourced by 0
004.61aa.962a
This indicates that a computer with a Mac of 0004.61aa.962a has the virus. At this point, you should immediately process this item and then use DHCP to find the corresponding computer name, and then find the virus source.
 
Here I will talk about how to deal with an emergency.
First, go to the vswitch mentioned above and use the following command to first remove the IP list from the vswitch
# Conf t
# Mac-address static *****. *****. ****** vlan ** drop
In this case, the entered mac-address static 0004.61aa.962a vlan 60 drop
Second, after the local switch clears the Mac-address of ARP, you also need to go to the core switch to clear and disable the address.
No mac-address static *****. *****. ***** vlan 60 drop