Viewing MAC-IP Anti-Spoof log events

To view MAC-IP Anti-Spoof log events

1. Navigate to MONITOR | Logs > System Logs.

2. Filter by the MAC-IP Anti-Spoof category to display events related to Layer 2 spoofing enforcement.

   

The following table describes the Layer 2 MAC-IP Anti-Spoof syslog messages generated for Native Bridge members (physical and VLAN sub-interface) and L2B interfaces.

Log Event	Interface Type	Severity	Description
L2 MAC Spoof Dropped — Physical NB Member	Native Bridge physical member	Alert	MAC-IP Anti-Spoof Check Enforced For Native Bridge interface at Layer2
L2 MAC Spoof Dropped IP Check Failed — Physical NB Member	Native Bridge physical member	Alert	MAC-IP Anti-Spoof Check Enforced For Native Bridge interface at Layer2 for IP
L2 ARP Poisoning Dropped — Physical NB Member	Native Bridge physical member	Alert	MAC-IP Anti-Spoof Cache Found With Source MAC But IP Does Not Match For Native Bridge interface
Blacklist Drop — Physical NB Member	Native Bridge physical member	Alert	MAC-IP Anti-Spoof Cache Found In Blacklist With Source MAC For Native Bridge interface
MAC-IP Anti-Spoof Check Enforced For Native Bridge VLAN Sub-Interface at Layer2	Native Bridge VLAN sub-interface	Alert	A frame was dropped on a NativeBridge VLAN sub-interface: source MAC not in the cache. Enforce mode was active.
MAC-IP Anti-Spoof Cache Found With Source MAC But IP Does Not Match For Native Bridge VLAN Sub-Interface	Native Bridge VLAN sub-interface	Alert	ARP poisoning attempt detected on a NativeBridge VLAN sub-interface.
MAC-IP Anti-Spoof Cache Found In Blacklist With Source MAC For Native Bridge VLAN Sub-Interface	Native Bridge VLAN sub-interface	Alert	Frame dropped: source MAC matches a blacklist entry on a NativeBridge VLAN sub-interface.
MAC-IP Anti-Spoof Check Enforced For L2B Ingress Interface at Layer2	L2B interface	Alert	A frame was dropped on an L2B interface because the source MAC is not in the MIS binding cache. Enforce mode was active.
Anti-Spoof Check Enforced For L2B Ingress Interface at Layer2 for IP	L2B interface	Alert	A frame was dropped: the source MAC was found in the cache but the associated IP does not match the cached binding.
MAC-IP Anti-Spoof Cache Found With Source MAC But IP Does Not Match For L2B Ingress Interface	L2B interface	Alert	ARP poisoning attempt detected on an L2B interface: ARP sender MAC is in the cache but claims a different IP address.
MAC-IP Anti-Spoof Cache Found In Blacklist With Source MAC For L2B Ingress Interface	L2B interface	Alert	A frame was dropped on an L2B interface: the source MAC matches a static blacklist entry.