In ARP poisoning, an attacker sends ARP replies claiming "the gateway 10.1.1.1 is at my MAC". Victims believe it (ARP has no checks) and send their traffic to the attacker instead of the router. Dynamic ARP inspection checks every ARP against the DHCP snooping binding table and drops any that lie.
DAI needs DHCP snooping: the bindings are its source of truth. Like snooping, every port is untrusted by default; you trust the uplink (where the router's own ARP is legitimate but not in the snooping table). On untrusted ports, an ARP is allowed only if a binding says that IP really belongs to that MAC.
| Command | Where | Does |
|---|---|---|
ip arp inspection vlan 10 | Global | Inspect ARP in these VLANs |
ip arp inspection trust | Interface (uplink) | Trust ARP from this port (no check) |
show ip arp inspection | What's on, forwarded and dropped counts |
In NetLab
▶ PC1 student@PC1:~$ sudo dhclient eth0 ▶ SW1 SW1>enable SW1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. SW1(config)#ip arp inspection vlan 1 SW1(config)#end *Mar 1 00:00:05.000: %SYS-5-CONFIG_I: Configured from console by console SW1#show ip arp inspection Source Mac Validation : Disabled Destination Mac Validation : Disabled IP Address Validation : Disabled Vlan Configuration Operation ACL Match Static ACL ---- ------------- --------- --------- ---------- 1 Enabled Active Vlan Forwarded Dropped DHCP Drops ACL Drops ---- --------- ------- ---------- --------- 1 0 0 0 0
Now PC1's own ARP (its real DHCP address) passes, but a forged ARP claiming to be the gateway would be dropped and logged. PC2 has a static address with no binding, so to let it use the network you'd add a static binding or an ARP ACL - beyond this lab, which uses DHCP everywhere.
Remember: DAI needs DHCP snooping on first. Trust the uplink. Untrusted ARP must match a binding or it's dropped.