Dynamic ARP Inspection (DAI)

1. Overview

Dynamic ARP Inspection (DAI) is a Layer 2 security feature deployed on network switches to mitigate ARP spoofing/poisoning attacks. ARP (Address Resolution Protocol) lacks inherent authentication, making it vulnerable to malicious actors who forge ARP replies to redirect traffic (e.g., man-in-the-middle attacks). DAI validates ARP packets by cross-referencing them against a trusted database of IP-MAC bindings, ensuring only legitimate ARP messages are forwarded.

2. Key Functions

• Prevent ARP Cache Poisoning: Block invalid ARP replies that map incorrect MAC addresses to IPs.
• Enforce Valid IP-MAC Bindings: Use DHCP snooping or static ARP ACLs to verify ARP packets.
• Rate Limiting: Throttle ARP traffic to prevent flooding attacks.
• Log Violations: Record dropped ARP packets for forensic analysis.

3. Operational Mechanism
4. Prerequisite: DHCP Snooping

DAI relies on the DHCP snooping binding table, which tracks valid IP-MAC leases from DHCP transactions. This table acts as the source of truth for legitimate bindings.

1. Trusted vs. Untrusted Ports

• Trusted Ports: Connected to authorized devices (e.g., routers, DHCP servers). ARP packets on these ports are not inspected.
• Untrusted Ports: Connected to end-user devices. All ARP traffic on these ports is validated.

1. Validation Process

1. ARP Request/Reply Received: On an untrusted port, the switch intercepts the ARP packet.
2. Binding Table Lookup:
• For ARP Requests: Checks if the sender’s IP-MAC pair exists in the DHCP snooping table.
• For ARP Replies: Validates both sender and target IP-MAC pairs.
3. Action:
• Valid Packet: Forwarded normally.
• Invalid Packet: Dropped, and a violation counter is incremented.

1. Handling Static IPs

Devices with static IPs (not DHCP-assigned) require manual entries in an ARP Access Control List (ACL) to bypass DHCP snooping checks.

4. Configuration Example

! Step 1: Enable DHCP Snooping 

Switch(config)# ip dhcp snooping 

Switch(config)# ip dhcp snooping vlan 10 

! Step 2: Define Trusted Ports (e.g., uplink to router) 

Switch(config)# interface GigabitEthernet0/1 

Switch(config-if)# ip dhcp snooping trust 

! Step 3: Enable DAI Globally 

Switch(config)# ip arp inspection vlan 10 

! Step 4: Configure DAI on Untrusted Ports (optional rate limiting) 

Switch(config)# interface range GigabitEthernet0/2-24 

Switch(config-if-range)# ip arp inspection trust  ! Untrusted by default 

Switch(config-if-range)# ip arp inspection limit rate 15 burst interval 1 

! Step 5: Add Static ARP ACLs for Non-DHCP Devices 

Switch(config)# arp access-list STATIC_DEVICES 

Switch(config-arp-acl)# permit ip 192.168.1.100 mac 00:1a:2b:3c:4d:5e 

Switch(config)# ip arp inspection filter STATIC_DEVICES vlan 10 

5. Use Cases

• Enterprise Networks: Protect against internal ARP-based attacks.
• Multi-Tenant Environments: Isolate tenant traffic in shared infrastructures.
• Financial/Critical Systems: Safeguard sensitive data from interception.

6. Benefits vs. Limitations

7. Best Practices

• Enable DHCP Snooping First: DAI is ineffective without a binding table.
• Audit Trusted Ports: Ensure only authorized devices (e.g., routers) are marked as trusted.
• Combine with Port Security: Restrict MAC addresses per port to enhance protection.
• Monitor Violations: Use logs to detect and investigate attack patterns.

bash

Switch# show ip arp inspection statistics 

8. Related Protocols & Features

• DHCP Snooping: Builds the IP-MAC binding table.
• Port Security: Limits MAC addresses per port.
• IP Source Guard: Prevents IP spoofing using similar bindings.

9. Attack Mitigation Workflow

Attacker Sends Fake ARP Reply        Switch with DAI Enabled 

  |---- ARP Reply (IP=10.0.0.1, MAC=Hacker_MAC) --->| 

  |                                                 | 

  |-- Check Against DHCP Snooping Table ------------| 

  |  (No Binding for 10.0.0.1 -> Hacker_MAC)        | 

  |                                                 | 

  |---- Packet Dropped, Log Entry Created ----------| 

10. Summary

Dynamic ARP Inspection (DAI) is a critical defense against ARP-based attacks, enforcing valid IP-MAC bindings through DHCP snooping or static ACLs. By validating ARP traffic on untrusted ports and dropping malicious packets, DAI ensures network integrity while complementing broader security strategies like port security and IP Source Guard. Proper configuration of trusted ports and binding tables is essential to maximize its effectiveness.