About this interactive
From the lesson:
- **ARP has no security:** anyone can answer an ARP request, or send a gratuitous ARP nobody asked for. ARP spoofing is sending the forged reply; ARP poisoning is the wrong entry it leaves in hosts' caches. Both put an attacker in the middle or cause a denial of service.
- **Dynamic ARP inspection** checks every ARP message on an untrusted port: its sender IP and MAC must match the DHCP snooping binding table. Trusted ports are not checked.
- **Static addresses** have no binding, so they need an ARP ACL listing them, or their ARP is dropped.
- **DHCP snooping must be on,** because it builds the binding table DAI uses.
(The video calls MAC address spoofing and ARP spoofing nearly the same thing. They are different: MAC spoofing changes a device's own MAC; ARP spoofing lies about which MAC owns an IP.)
What you'll learn
- Predict whether dynamic ARP inspection forwards or drops an ARP message: trusted ports pass; on untrusted ports the sender's IP and MAC must match the DHCP snooping binding table or an ARP ACL
- Explain how DAI stops ARP spoofing and ARP poisoning, and why it needs DHCP snooping turned on
Aligned to
Cisco CCNA
5.7
Configure and verify Layer 2 security features
Key terms
- Dynamic ARP Inspection
DAI
- A security feature on managed switches that validates ARP messages against the DHCP snooping binding database, dropping packets with invalid IP-to-MAC address mappings.
- ARP Spoofing
- An attack technique in which a threat actor sends forged ARP reply messages to associate their MAC address with a legitimate IP address, redirecting traffic to their device.
- ARP Poisoning
- The result of ARP spoofing in which the ARP caches of devices on a network are corrupted with false IP-to-MAC address mappings, causing traffic to be misdirected.
- DHCP Snooping Binding Database
- A table maintained by DHCP snooping that records IP address, MAC address, and port mappings to validate DHCP messages and detect illegitimate requests.
- Gratuitous ARP
- An unsolicited ARP reply sent by a device to update the ARP caches of other devices on the network without a prior request.
- DHCP Snooping
- A switch security feature that classifies ports as trusted (connected to legitimate DHCP servers) or untrusted (connected to end devices) and drops DHCP server responses received on untrusted ports. It builds a binding database of valid IP-to-MAC-to-port mappings used by other Layer 2 security features like Dynamic ARP Inspection.
Topics
Dynamic Arp Inspection
Arp Spoofing
Arp Poisoning
Layer 2 Security
Interactive
Streak Sort
About TechKnowSurge
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →