Detecting CAM table overflow?

[paulgear]

Hi folks,

I'm just doing a bit of research on mitigating CAM table overflow attacks, and i'm wondering if there are ProVision and Comware equivalents of Cisco's "show mac address-table count".  The Cisco command compatibility document i've got doesn't cover MAC address table commands.  I'd really like to see how close to my switches CAM table limits i'm running.

My main switches are a ProCurve 3400cl running M.10.76 and an H3C 5500 EI running Comware 5.20 r2208.  I found http://evilrouters.net/2010/04/06/hidden-procurve-commands/ which lists a hidden command to do it, but i was hoping for something more, well ..., supported.

Thanks,

Paul

[HzE]

How about SNMP?

me@linux:~$ snmpget -v 2c .1.3.6.1.4.1.11.2.14.11.5.1.9.12.1.0 STATISTICS-MIB::hpSwitchFdbAddressCount.0 = INTEGER: 74

I have this value monitored on all switches. Also with some network surveillance software (e.g.. Nagios) you can create automatic alarms based on this OID.

[Michael_Breuer]

Hi Paul,

maybe also interested for you: recent firmware releases for the ProVision switches are including a feature called "instrumentation monitor": you can specify thresholds for certain counters. One of it is the mac address count . Violation will create log messages like this:

W 05/27/06 12:10:16 inst-mon: Limit for MAC addr count (300) is exceeded (321)

http://h20000.www2.hp.com/bizsupport/TechSupport/CoreRedirect.jsp?redirectReason=DocIndexPDF&prodSeriesId=1827663&targetPage=http%3A%2F%2Fbizsupport1.austin.hp.com%2Fbc%2Fdocs%2Fsupport%2FSupportManual%2Fc03112967%2Fc03112967.pdf

Cheers,

Michael

[DavidDCSD]

Very nice I was completely unaware of this feature.