Dynamic ARP inspection (DAI) helps prevent ARP spoofing or poisoning by not relaying invalid or gratuitous ARP replies out to other ports in the same VLAN. DAI intercepts all ARP packets on the
untrusted ports and verifies for valid IP-to-MAC binding based on a the bindings database that is built by DHCP snooping. In addition, to handle hosts that use statically configured IP addresses, DAI can validate ARP packets against user-configured ARP ACLs.

Performing Tasks

• Forwards ARP packets that are received on a trusted interface without any checks
• Intercepts all ARP packets on untrusted ports
• Verifies that each intercepted packet has a valid IP-to-MAC address binding before forwarding packets that can update the local ARP cache
• Drops, logs, or drops and logs ARP packets with invalid IP-to-MAC address bindings

Used to Mitigate

• ARP Spoofing

More Understanding

• Dynamic ARP Inspection

References

• Understanding and Configuring Dynamic ARP Inspection
• DHCP Snooping and Dynamic ARP Inspection