Layer 2 MAC-IP Anti-Spoof Logs

When Layer 2 MAC-IP Anti-Spoof enforcement is enabled on Native Bridge member interfaces or L2B interfaces, the following log events are generated.

Spoofed ARP poisoning detected: Logged when an ARP packet's sender MAC is found in the cache but the ARP sender IP does not match the cached IP — indicating an ARP poisoning attempt. Includes source MAC, claimed IP, actual cached IP, and interface.

• X2 starts attack by sending APRs related to 192.168.100.1 to 192.168.100.255 to X0 and X1, claiming that these IPs belong to it. But, X2 client can't see any X0 and X1 traffic as X0 and X1 ARP caches cannot be poisoned.
• No ping drops seen on X0 and X1 clients.

MAC-IP Anti-Spoof L2 packet dropped: Logged when a Layer 2 packet (ARP, IP, DHCP, NetBIOS) is dropped on a Native Bridge member or L2B interface because the source MAC address is not in the Anti-Spoof Cache. The log entry includes: source MAC, source IP (if available), ingress interface name, and drop reason code.

Log events for Layer 2 MAC-IP Anti-Spoof use the same log category and severity levels as existing Layer 3 MAC-IP Anti-Spoof events.