SonicOS 8 Monitor Administration Guide
Table of Contents
MAC-IP Anti-Spoof Enforcement
When a frame is dropped by MAC-IP Anti-Spoof enforcement on a Layer 2 Bridge (L2B) interface or a Native Bridge VLAN sub-interface, the Packet Monitor records the reason for each drop.
-
Navigate to MONITOR | Tools & Monitor > Packet Monitor.
-
Filter by the MIS drop codes to isolate MAC-IP Anti-Spoof enforcement events.
Rate Limiting
Syslog events for MAC-IP Anti-Spoof violations are rate-limited to prevent log flooding during sustained attack scenarios such as ARP storms. When multiple violations occur in rapid succession on the same interface, the firewall consolidates repeated events to avoid overwhelming the syslog server.
To view a complete record of all spoof violations (including those suppressed by rate limiting), run the following command in the CLI:
show mac-ip-anti-spoof detected-list
For more information, see Spoof Detection List in the SonicOS 8 System Administration Guide.