Dynamic ARP Inspection (DAI)

The ARP Process

From a layer 2 perspective, IPv4 relies heavily on address resolution protocol, or ARP. ARP has some inherent flaws in it that allow an attacker to be able to launch an attack against the network.

When a machine is connecting to another resource on the network, it is probably connecting to, or knows of, the IP address that it's trying to connect to. Or you're trying to connect to some sort of name, in which case it does a DNS resolution to come up with an IP address. But in either case we're communicating via IP to another device on the network. The thing is, we're in a layer 2 network, and so now what we have to do is translate from that IP address and find out what the MAC address is.

When this demo laptop sends out a message on the network, it will ask, and it will do an address resolution protocol, to find out what that MAC address is for 10.1.10.21, and it will send this out. It'll be a broadcast that's sent out across the network, and then this device will reply back with the MAC address that is for that machine. And so that way the demo laptop can send that message out with the correct MAC address, and the switches will know how to forward that to get to its final destination.

The problem is that ARP is not secure in any way. So anyone can listen in on these conversations, or even worse yet, can insert a reply back that is not correct.

ARP Spoofing and ARP Poisoning

An attacker can use ARP spoofing and ARP poisoning in order to insert themselves in the middle of this conversation. So the attacker will conduct a denial of service attack or a man in the middle attack by sending ARP replies out to the different hosts.

I'm going to use a specific example to show you how this process works. So this demo laptop needs to get to the outside world. It needs to get to maybe a web server that's inside the cloud, so it knows that it's going to need to reach out to its default gateway. In this case the default gateway is this layer 3 switch right here. And so what it's going to do is, it knows the IP address of its default gateway, it's 10.1.10.1. So what it's going to do is send out an ARP request to find out what is the MAC address that belongs to 10.1.10.1. And of course, in a regular functioning network, this layer 3 switch will reply back with its own MAC address, and then this demo laptop would put that in its caching table.

But what an attacker can do on this network is it can reply to the same message and give its own MAC address — the attacker's machine can be given to this demo laptop. And so now it's got an incorrect MAC address set up in its cache, and so now this machine will send off this packet that's supposed to be destined to somewhere out in the internet, and it's going to send it to this attacker. And this attacker then has that information and can conduct a man in the middle attack.

So that's just one example, and there's many different examples, but this is where this attacker is spoofing an ARP reply. And so that's where ARP spoofing comes in: it's spoofing an ARP reply to send back to the machines on this network.

There are other ways to do the same thing. This attacker could actually broadcast out an ARP reply to all of the machines. This is called a gratuitous ARP, one that's not requested but is sent out to all the devices on the network. And then all of the devices on the network will poison their cache. That's what cache poisoning is: all of the cache on these devices on that network will have the wrong MAC address, and so they'll all send their frames to this attacker device, who's acting as the default gateway.

So really, when we talk about ARP spoofing and ARP poisoning, they're really very similar, or describing a couple different aspects of this type of attack. The ARP spoofing is the act of spoofing an ARP reply, versus the ARP poisoning is poisoning the cache that sits on every single machine on that network. So that's the difference between the two. They're just two different aspects to this type of attack.

Mitigations and MAC Address Spoofing

There are a lot of different tools that can be used to carry out this type of attack. It's a very simplistic attack really, but very effective.

So some ways to mitigate this. Number one, we've learned about port security, and we can limit the number of MAC addresses; that potentially could eliminate some of the risk that's involved with this. Or even if you have statically assigned MAC addresses on your switch, which could be very troublesome trying to work with, it could be very problematic from a management standpoint. So we also have dynamic ARP inspection, which really attacks the heart of this issue and is the real resolution for mitigating this issue.

Then we have MAC address spoofing. MAC address spoofing is when you change the MAC address on the computer, versus ARP spoofing is when you're mimicking an ARP reply from a different MAC address. But essentially they have the same effect on the network, and essentially they can be really the same thing. And so MAC address spoofing and ARP spoofing are very close if not the same thing. There's quite a bit of overlap between those two.

Dynamic ARP Inspection

So the resolution for these is dynamic ARP inspection. Dynamic ARP inspection takes a look at the ARP messages and makes sure that the ARP messages are legitimate messages. And it's very similar to DHCP snooping — in fact, you have to have DHCP snooping turned on in order to use dynamic ARP inspection. So let's take a look at dynamic ARP inspection and see what some of the rules are and how we can set this up on our devices.

Now a big part of this is it uses the DHCP snooping binding database. That's why you have to have the DHCP snooping turned on, because the DHCP snooping binding database records the IP address, the MAC address and the port numbers of devices on your network. And so it's going to use that information to make sure that the information coming across that specific port matches up with the MAC address and IP address that's inside that binding database.

Here's the process that dynamic ARP inspection does to know whether it's going to drop a frame or if it's going to forward the frame. And so first of all, what happens is when a frame comes into the switch on a particular port, it's going to first of all check that port to see if it's trusted. If it's trusted, then it's just going to send it — hey, it's a trusted port, so why not send it. If it's an untrusted port, then at that point in time it's going to look at that frame's source IP address and MAC address of that ARP reply, and then it's going to look it up to make sure it's legitimate. Is the IP address and MAC address that that machine is claiming inside the DHCP snooping binding table? And so if it is, then it can forward it, but if it isn't, then it could drop it.

It does check one more thing with it, and that is that not all devices on your network are necessarily going to get a DHCP address. So in those events we need some other way to be able to check that information. So we can actually manually configure what's called an ACL, an access control list, and apply it so that dynamic ARP inspection checks that as well. And then it will verify whether this is the legitimate ARP or is illegitimate, and it's going to drop it. So that's how dynamic ARP inspection works.

So when we go to enable dynamic ARP inspection, then what we're going to do is first of all we're going to enable DHCP from a global level. We have to enable DHCP snooping on the VLAN itself, and then we enable dynamic ARP inspection on the VLAN, and then we configure any trusted ports to it. So a fairly simple setup to set this up, and it will add quite a bit of protection to your network.