This article applies to all Aruba Mobility Controllers running version 6.x and above.
In Aruba OS, we have the option to detect ip and arp spoofing. And based on the spoofing detected, controller will send out SNMP trigger.
Below are the triggers sent out:
wlsxNIpSpoofingDetected is the trap sent when ipv4 spoofing is detected.
(Aruba3400) #show snmp trap-queue | include a4:4e:31:7e:ea:fc
2014-09-16 11:10:03 Station a4:4e:31:7e:ea:fc is black listed because 11.
(CTRL-E) #show snmp trap-queue | include 02:9e:3f:20:cd:c7
2014-09-29 19:05:52 Station 02:9e:3f:20:cd:c7 is black listed because 8.