What is Dynamic ARP Inspection (DAI) ?
Posted by: Yasir Irfan
ARP, Cisco, Cisco Learning, Cisco Tips, DAI, DHCP, DHCP Snooping, Dynamic ARP Inspection, IP to MAC, Network Security, Security Features, Switches, Switching
Dynamic ARP inspection is a security feature which validates ARP packet in a network. Dynamic ARP inspections validates the packet by performing IP to MAC address binding inspection stored in a trusted database (the DHCP snooping database) before forwarding the packet. Dynamic ARP intercepts, logs, and discards ARP packets with invalid IP-to-MAC address bindings. This capability protects the network from certain man-in-the-middle attacks.
Dynamic ARP inspection ensures that only valid ARP requests and responses are relayed.
The switch performs these activities:·
Intercepts all ARP requests and responses on untrusted ports ·
Verifies that each of these intercepted packets has a valid IP-to-MAC address binding before it updates the local ARP cache or before it forwards the packet to the appropriate destination·
Drops invalid ARP packets
Comment
RSS Feed
Email a friend
