How does Dynamic ARP Inspection stop ARP spoofing?
Show the answer
Say this first
DAI intercepts every ARP request and reply arriving on untrusted ports in the VLANs where it is enabled, and checks the sender MAC and IP against the DHCP snooping binding table and any static ARP ACLs. If a host on Gi1/0/7 claims the gateway's IP and that pairing is not in the table for that port, the ARP is dropped and logged. Uplinks are set as trusted so ARPs from the gateway and other switches pass. Untrusted ports are limited to 15 ARP packets per second by default; going over err-disables the port.
Go deeper
Configuration
ip arp inspection vlan 10
ip arp inspection validate src-mac dst-mac ip
!
arp access-list STATIC-HOSTS
permit ip host 10.10.10.5 mac host 0050.5689.0005
ip arp inspection filter STATIC-HOSTS vlan 10
!
interface GigabitEthernet1/0/48
ip arp inspection trustExtra validation
src-mac: the Ethernet source MAC must equal the sender MAC inside the ARP packet.dst-mac: in replies, the Ethernet destination must equal the target MAC inside the ARP packet.ip: rejects nonsense addresses such as 0.0.0.0, 255.255.255.255 and multicast. Give all three in one command. Eachip arp inspection validateline replaces the previous one.
What a drop looks like
%SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Res) on Gi1/0/7, vlan 10.([0050.5689.0bad/10.10.10.1/0050.5689.1a2b/10.10.10.51/09:12:44 UTC Tue Nov 10 2026])Reading the bracket: sender MAC, sender IP, target MAC, target IP, time. A host at 0050.5689.0bad told 10.10.10.51 that it owns the gateway address 10.10.10.1.
Static ARP ACLs
Hosts with fixed addresses have no DHCP binding. An ARP ACL lists their IP and MAC. With the static
keyword on the filter, only the ACL is used and the binding table is not consulted for that VLAN.
They will ask next
Why does DAI need DHCP snooping when you only care about ARP?
DAI has no knowledge of which IP belongs to which MAC on which port. The DHCP snooping binding table is that knowledge. Without snooping, only ARP ACL entries can be validated.
What do you do on a port with many legitimate hosts behind it, like a small switch or an AP?
Raise the limit on that port with
ip arp inspection limit rate, or trust it only if the device behind it runs its own ARP protection.
Traps
- Enabling DAI before the binding table is populated. Hosts that got their lease earlier are not in the table yet and are cut off.
- Forgetting to trust the uplink, which drops the gateway's own ARP replies.