Probe counter state for neighbor discovery

A method comprising:

• receiving, at a network appliance, a copy of a neighbor discovery packet on a control plane of a network that originated at a first port on a data plane of the network,
• wherein the neighbor discovery packet copy includes identification information including:
• an internet protocol address, a media access control (MAC) address, and the first port;
• comparing the identification information to a binding state table to determine that the internet protocol address and the MAC address match the binding state table, but the first port does not match a previous port on the binding state table for the internet protocol address;
• determining a state of a probe counter associated with the internet protocol address;
• and
• determining a security action to perform based on the state.

A non-transitory machine-readable storage medium storing instructions that, if executed by a physical processing element of a network appliance, cause the network appliance to:

• receive a neighbor discovery packet copy on a control plane of a network that originated at a first port on a data plane of the network;
• wherein the neighbor discovery packet copy includes identification information including:
• an internet protocol address, a media access control (MAC) address, and the first port;
• compare the identification information to a binding state table to determine that the internet protocol address and the MAC address match the binding state table, but the first port does not match a previous port on the binding state table for the internet protocol address;
• probe for an expected device on the previous port;
• and
• update a state of a probe counter associated with the internet protocol address,