Catch the ARP poisoner
DHCP snooping is already set up and PC1 has leased an address. Add dynamic ARP inspection for VLAN 1 so that a poisoned ARP (PC2 pretending to be the gateway 10.1.1.1) is dropped, while PC1's own ARP still works. Remember to trust the uplink.
How it works: this is VulnTech NetLab, a network simulator running in your browser. Click a device in the diagram to open its console and type commands, just like on real equipment (? shows help, Tab finishes a word). Click a cable to inspect it. Tasks tick themselves off as you complete them; questions are answered in the box under each task. Your work is kept if you reload; Reset starts the network over.
Solution explanation
PC1 first leases an address so the snooping binding exists. DAI then allows PC1's ARP (it matches the binding) but drops PC2's forged gateway ARP, which no binding backs. The uplink is trusted because the router's own ARP isn't in the snooping table.
Show solution
[PC1]
sudo dhclient eth0
[SW1]
enable
configure terminal
ip arp inspection vlan 1
interface g0/1
ip arp inspection trust
end
show ip arp inspection