die "invalid IP address\n" if (! ($ipaddr =~ /^(2([0-4]\d|5[0-5])|1?\d{1,2})(\.(2([0-4]\d|5[0-5])|1?\d{1,2})){3}$/));

die "invalid MAC address\n" if (! ($macaddr =~ /^[0-9A-Fa-f]{2}(:([0-9A-Fa-f]){2}){5}$/));

die "invalid MAC address\n" if (! ($macaddr =~ /^[0-9A-F]{2}(:([0-9A-F]){2}){5}$/im));

#!/usr/bin/perl
#
# ACL Generator for preventing ARP Spoofing at DLink switches
# Licensed under GNU GPL?
# Written by KabaH, http://forum.dlink.ru/viewtopic.php?p=254088#254088
# v.1.0.3
# Last edit by Dyr, 2008-11-07
#

if ($#ARGV != 3 ) {
     die "ACL Generator for preventing ARP Spoofing at DLink switches\n"
         ."USAGE: $0 ip-address mac_address profile_id port\n"
         ."FORMAT: x.x.x.x (ip-address) xx:xx:xx:xx:xx|xx-xx-xx-xx-xx (mac_address) 1..255 (profile_id) 1..26 (port)\n"
         ."EXAMPLE: $0 192.168.0.1 01-02-03-04-05 100 1\n";
}else {
    $ipaddr=$ARGV[0];
    $macaddr=$ARGV[1];
    $profile_id=$ARGV[2];
    $port=$ARGV[3];
}
chomp($port);
$access_id = $port;

$macaddr =~ s/\-/:/g; #Convert MAC from xx-xx-xx-xx-xx format to xx:xx:xx:xx:xx

die "invalid IP address\n"      if ( $ipaddr !~ /^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$/ );
die "invalid IP address\n"      if ( $ip1 > 255 || $ip2 > 255 || $ip3 > 255 || $ip4 > 255 );
die "invalid MAC address\n"     if ( $macaddr !~ /^[0-9A-F]{2}:[0-9A-F]{2}:[0-9A-F]{2}:[0-9A-F]{2}:[0-9A-F]{2}:[0-9A-F]{2}$/i );
die "Invalid profile id\n"      if ( $profile_id < 1 || $profile_id > 255 );
die "Invalid port\n"            if ( $port < 1 || $port > 26 );

my $hex_ip=sprintf ("%.2X"x4,split(/\./,$ipaddr));
($m1,$m2,$m3,$m4,$m5,$m6) = split (/:/, $macaddr);


print "\n#Packet mask for permit only specific ARP packets\n";
print "create access_profile packet_content_mask "
     ."offset_16-31 0xFFFFFFFF 0xFFFFFFFF 0xFFFFFFFF 0xFFFFFFFF "
     ."offset_32-47 0xFFFFFFFF 0x0 0x0 0x0 "
     ."profile_id $profile_id\n";

$profile_id++;

print "#Packet mask for deny all another ARP packets\n";
print "create access_profile packet_content_mask "
     ."offset_16-31 0xFFFF0000 0x0 0xFFFF0000 0x0 "
     ."profile_id $profile_id\n\n";

$profile_id--;
print "#ACL for allow ARP packets only for sender IP $ipaddr with sender MAC $macaddr at port $port\n";
print "config access_profile profile_id $profile_id add access_id $access_id packet_content_mask "
     ."offset_16-31 0x08060001 0x08000604 0x0002$m1$m2 0x$m3$m4$m5$m6 "
     ."offset_32-47 0x$hex_ip 0x0 0x0 0x0 "
     ."port $port permit\n";

$profile_id++;

print "#Deny all another ARP packets\n";
print "config access_profile profile_id $profile_id add access_id $access_id packet_content_mask "
     ."offset_16-31 0x08060000 0x0 0x00020000 0x0 "
     ."port $port deny\n\n";