Dynamic Arp inspection (DAI) could be used to protect against ARP Spoofing attacks on local networks.
Control Type: Technical
Control Function: Preventive
Description: The Address Resolution Protocol (ARP) is used on networks to learn the MAC Address of a known IP address for switching purposes. Without knowing the destination MAC address, packets can’t get to their destination. ARP Spoofing is a local network attack that involves an adversary sending fake ARP messages to other clients on a local network, with the hopes of them associating the adversaries MAC address with a legitimate IP address. For example, an adversary may poison the ARP cache to associate their own laptop network card with the IP address of the network’s default gateway router. This is a classic Man in the Middle (MitM) attack, as clients will be none the wiser and send packets destined for the default gateway to the adversary’s device.
Dynamic Arp Inspection (DAI) is a Layer 2 security feature that filters ARP messages that are received on Untrusted Ports. Remember that Untrusted Ports are switch ports connected to client devices such as laptops, desktops, printers, and smart devices. Trusted Ports are reserved for network infrastructure devices involved in the DHCP process, such as routers, switches, and servers. A Binding Table is created by DHCP Snooping to map IP addresses to MAC addresses for the clients connected to Untrusted Ports. DAI uses this binding table to verify the validity of communications currently occurring on the network.. Whenever an ARP message comes through an untrusted port, DAI inspects the Send MAC and Sender IP and compares them to entries in the binding table. If there is a match, the ARP message is forwarded. If there isn’t, it is dropped. In addition, DAI supports Rate Limiting to protect the switch from denial of service attacks from adversaries spamming them with ARP messages.