Port-Security - Security Violation Count

Hello,

I have noticed that if I use shutdown as my parameter the security violation count works but if I use the parameter protect it does not increment the security violation counter? Is this normal or am I missing something?

Thank you in advance!

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

Welly_59

Totally normal.

redgunner

as a follow up question - if I use the protect mode, then how as an administrator would I know if something is plugged in that shouldn't

MitM

redgunner wrote: »

as a follow up question - if I use the protect mode, then how as an administrator would I know if something is plugged in that shouldn't

As far as I know, you wouldn't know. You'd have to use restrict mode instead

Welly_59

Yep. The only difference between restrict and protect is that one increments counters and the other doesnt

rob42

redgunner wrote: »

as a follow up question - if I use the protect mode, then how as an administrator would I know if something is plugged in that shouldn't

I'm sure that the 'show port-security interface' command will indicate dropped frames, indicating a port violation.