How does Dynamic ARP Inspection on an Ethernet switch decide to drop a forged ARP packet, and what does it depend on?

## What it is, and what it is not Dynamic ARP Inspection is a name used for a switch capability: the switch examines ARP packets that cross it and drops the ones that contradict known address bindings. It is a vendor-implemented feature, not a protocol defined in an RFC, so details such as the exact optional checks vary. The standards-track analogue is **SAVI**: RFC 7039 (Informational) is the framework, and RFC 7513 (Standards Track) specifies it for addresses learned through DHCP. ## The decision, step by step For an ARP packet arriving on a switch port in a given VLAN: 1. **Is the port trusted?** Trusted ports, typically uplinks toward other inspecting switches or toward infrastructure, are not inspected. Untrusted ports, typically host-facing access ports, are. 2. **Look up the sender IP in the binding table.** The table maps IP, MAC, VLAN and port, and is normally filled by DHCP snooping, whose mechanics belong to a neighbouring topic. 3. **Compare the pair.** If the sender MAC matches the binding, forward. If there is no binding or the MAC differs, **drop** and optionally log. 4. **Optional extra validation**, an implementation choice: the ARP sender MAC against the Ethernet source MAC, and the ARP target MAC against the Ethernet destination MAC on replies, plus rejecting clearly invalid addresses. ``` on ARP packet P arriving on port X in VLAN V: if X is trusted: forward P else: b = binding_table.lookup(V, P.sender_ip) if b is none or b.mac != P.sender_mac: drop P (and log) else: forward P ``` RFC 7513 §8.2 states the same intent in IETF terms, for attachments being validated: ARP messages whose sender protocol address is neither all zeros nor bound to that attachment MUST be discarded, and ARP Replies whose target protocol address is not bound MUST be discarded too. The all-zeros allowance is there so an RFC 5227 ARP Probe, which uses sender IP 0.0.0.0, is not blocked. ## What it depends on - **A complete binding table.** Anything missing is treated as invalid. Hosts with static addresses, printers or servers, need static bindings or an ARP-specific exemption, otherwise they lose connectivity. - **Correct trust boundaries.** A trusted port is a hole: if an attacker can reach a trusted port, inspection is bypassed. Marking a host-facing port trusted is a classic mistake. - **Inspection everywhere the VLAN reaches.** Between inspecting switches the links are trusted, so every access switch must inspect its own host ports. - **Rate limiting.** An untrusted port may have its ARP rate limited as well, an implementation setting. ## What it does and does not stop | It stops | It does not stop | |---|---| | Forged claims of another host's IP from an untrusted port | A compromised trusted port or an unmanaged switch hiding hosts behind one port | | Gateway impersonation from an access port | Attacks at other layers, such as a rogue DHCP lease | | Poisoning of victims and the gateway alike, since the forged packets traverse the switch | A table wrong because of a rogue DHCP server it trusted | Note the last row: if the binding table was filled by a rogue DHCP server, DAI faithfully enforces the attacker's bindings. The table's integrity is therefore a DHCP-side question, owned by the neighbouring topic. ## Operating it - Roll out in log-only mode where the implementation offers it, find static hosts, then enforce. - Keep the trusted-port list short and reviewed. - Pair it with limits on ARP rate so an attacker cannot flood the switch's CPU with packets to inspect. ## Interview summary Say: *the switch validates each ARP packet from untrusted ports against a binding table, normally learned by DHCP snooping, and drops the mismatches; it fails open or closed depending on the table and the trust boundaries.* Name the static-host gap, and cite RFC 7513's SAVI rule as the IETF version.