What Is ARP?

ARP (Address Resolution Protocol) is used in IPv4 networks to discover the MAC address associated with an IP address on the local network.

For example, if PC-A wants to communicate with:

```

IP Address: 192.168.10.20
MAC Address: AA:AA:AA:AA:AA:AA 

PC-A can send an ARP Request asking:

```

"Who has 192.168.10.20?" 

The device owning that IP responds with its MAC address.

What Is ARP Spoofing?

ARP spoofing is an attack where an attacker sends forged ARP messages to associate the attacker's MAC address with another device's IP address.

A common target is the network's default gateway.

```

Normal Network

PC-A
192.168.10.10
|
| ARP
v
Gateway
192.168.10.1
MAC: GG:GG:GG 

An attacker may attempt to convince PC-A that:

```

192.168.10.1 = ATTACKER MAC 

If successful, traffic intended for the gateway may be redirected through the attacker.

Example of an ARP Spoofing Attack

         Switch
      /     |      \
     /      |       \
   PC-A   Attacker   Router
   .10      .50       .1
```

Attacker sends forged ARP information:

192.168.10.1 -> Attacker MAC

PC-A may believe:

Gateway IP 192.168.10.1
=
Attacker MAC 

This can enable attacks such as:

• Man-in-the-middle attacks
• Traffic interception
• Session manipulation
• Traffic redirection
• Network disruption

What Is Dynamic ARP Inspection?

Dynamic ARP Inspection (DAI) examines ARP packets entering a switch and checks whether the IP-to-MAC information appears valid according to the switch's trusted binding information.

When an ARP packet does not pass validation, the switch can drop it.

          DHCP Server
               |
         Trusted Port
               |
         +-----------+
         |  Switch   |
         |    DAI    |
         +-----------+
          /         \
         /           \
      PC-A          Attacker
    Valid ARP       Fake ARP
         |             |
         +------X------+
                |
          Invalid ARP
            DROPPED
    

How DAI Works

A typical DAI deployment works like this:

1. DHCP Snooping is enabled on the switch.
2. The switch learns legitimate IP-to-MAC bindings.
3. DAI is enabled for the required VLAN.
4. An ARP packet arrives on an untrusted interface.
5. The switch compares the ARP information with its binding information.
6. If the ARP information is valid, the packet can be forwarded.
7. If validation fails, the packet can be dropped.

DAI and DHCP Snooping

DHCP Snooping and DAI are commonly used together because DHCP Snooping can build a binding database containing information such as:

DAI can use this information to validate ARP messages.

Trusted and Untrusted Interfaces

DAI uses the concept of trusted and untrusted interfaces.

Untrusted Ports

Client-facing ports are commonly left untrusted. ARP packets arriving from these interfaces are subject to validation.

Trusted Ports

Ports connected toward trusted network infrastructure may be configured as trusted when the topology requires it.

```

Client PC
|
| Untrusted
v
+---------+
| Switch  |
|   DAI   |
+---------+
|
| Trusted
v
DHCP Server / Trusted Network Device 

The trust configuration must match the actual network topology. Incorrectly trusting a client-facing interface can weaken the protection provided by DAI.

Basic Cisco DAI Configuration

First, enable DHCP Snooping:

```

Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10 

If the DHCP server is reached through GigabitEthernet0/1, that interface may be trusted according to the topology:

```

Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)# ip dhcp snooping trust 

Now enable DAI for VLAN 10:

```

Switch(config)# ip arp inspection vlan 10 

Rate Limiting ARP Packets

Cisco switches can also be configured to limit the number of ARP packets accepted on an interface over a period of time.

```

Switch(config)# interface gigabitEthernet 0/2
Switch(config-if)# ip arp inspection limit rate 15 

This can help protect against excessive ARP traffic, but the appropriate value depends on the network design and traffic patterns.

Useful Verification Commands

Check DHCP Snooping:

```

show ip dhcp snooping 

Check the DHCP Snooping binding database:

```

show ip dhcp snooping binding 

Check DAI configuration and status:

```

show ip arp inspection 

Check DAI statistics:

```

show ip arp inspection statistics 

DAI Practical Example

```

VLAN 10

```
         Switch
      +-----------+
      |    DAI    |
      +-----------+
       /    |    \
      /     |     \
    PC-A  PC-B  Attacker
     .10   .20     .50
```

DHCP Snooping Binding:

PC-A
192.168.10.10
AA:AA:AA:AA:AA:10

PC-B
192.168.10.20
BB:BB:BB:BB:BB:20 

Suppose the attacker sends an ARP message claiming:

```

192.168.10.10
=
Attacker MAC 

The switch can compare this information against its trusted binding information.

If the information does not pass validation, the ARP packet can be dropped.

DAI vs DHCP Snooping

These features can work together as part of a broader Layer 2 security strategy.

DAI vs ARP Spoofing

Important Limitation

DAI is not a complete network security solution.

It focuses specifically on ARP validation at the Layer 2 switching level. A secure network should also use appropriate controls such as VLAN segmentation, access control, endpoint security, authentication, monitoring, and secure network design.

Packet Tracer Lab: Configure DAI

Build a simple topology:

```

PC1 --------

Switch -------- DHCP Server
/
PC2 --------/ 

Suggested configuration steps:

1. Create VLAN 10.
2. Assign PC ports to VLAN 10.
3. Enable DHCP Snooping for VLAN 10.
4. Configure the appropriate trusted interface.
5. Enable DAI for VLAN 10.
6. Verify the DHCP Snooping binding table.
7. Verify DAI status and statistics.

Useful commands:

```

show ip dhcp snooping
show ip dhcp snooping binding
show ip arp inspection
show ip arp inspection statistics 

Quick Quiz

1. What attack does DAI primarily help protect against?

2. Which feature commonly provides the binding information used by DAI?

3. Should every client-facing port automatically be trusted?

4. Which command enables DAI for VLAN 10?

Key Takeaways

• DAI stands for Dynamic ARP Inspection.
• DAI helps protect IPv4 networks from ARP spoofing and poisoning.
• DAI validates ARP information before forwarding it.
• DHCP Snooping can provide the IP-to-MAC binding information used by DAI.
• Client-facing interfaces are commonly untrusted.
• Trusted interfaces must be configured according to the network topology.
• DAI is a Layer 2 security feature.
• DAI works well alongside DHCP Snooping and IP Source Guard.