Hi BAZ,
IPSG is short for IP Source Guard. When functioning as a Layer 2 device, the device uses the binding table to defend against IP source spoofing attacks.
IPSG checks IP packets based on DHCP dynamic and static binding tables. When forwarding an IP packet, the device compares the source IP address, source MAC address, interface, and VLAN information in the packet with information in the binding table. If the information matches, the user is authorized and the packet can be forwarded normally. Otherwise, the device considers the IP packet as an attack packet and discards the IP packet.
For example, a user goes online through DHCP. After the switch goes online, the switch generates a binding table for the user based on the DHCP ACK packet. The binding table contains the source IP address, source MAC address, port number, and VLAN information of the user. When a user sends an IP packet, SwitchA checks whether the IP packet matches the binding table of the user. If the IP packet matches the binding table of the user, SwitchA allows the packet to pass through. Otherwise, SwitchA discards the IP packet. In this way, IP packets sent by authorized users are allowed to pass through, but attackers send fake IP packets that cannot match the binding table. As a result, the packets are discarded and cannot attack other users.
