Dynamic ARP inspection (DAI) protects against ARP spoofing, also called ARP poisoning or ARP cache poisoning. It’s a security feature on network switches that intercepts ARP packets, checks whether the IP and MAC address information inside them is legitimate, and drops any packet that doesn’t match a known valid pairing. The practical result is that an attacker sitting on your local network can’t trick other devices into sending traffic through their machine.
How ARP Spoofing Works
To understand what DAI stops, you need to understand what it’s stopping. ARP (Address Resolution Protocol) is how devices on a local network figure out which physical hardware address (MAC address) belongs to a given IP address. When your computer wants to talk to another device on the same network, it broadcasts an ARP request asking “who has this IP?” and the device with that IP replies with its MAC address. Your computer then caches that pairing and sends traffic to that MAC address.
The problem is that ARP has no built-in authentication. Any device on the network can send an ARP reply claiming to own any IP address, and other devices will trust it. An attacker exploits this by sending forged ARP replies that associate their own MAC address with someone else’s IP, typically the default gateway. Once that poisoned entry lands in a victim’s ARP cache, the victim unknowingly routes all outbound traffic through the attacker’s machine. This enables man-in-the-middle attacks, where the attacker can silently read, modify, or block traffic between two devices that believe they’re communicating directly with each other.
What DAI Actually Does
DAI sits on the switch and intercepts every ARP request and reply arriving on untrusted ports. Before the switch forwards the packet or allows it to update any device’s ARP cache, DAI compares the IP-to-MAC address binding in the ARP packet against a trusted reference. If the MAC address or IP address doesn’t match a valid entry, the switch drops the packet entirely. The forged information never reaches other devices, so their ARP caches stay clean.
That trusted reference is almost always the DHCP snooping database. DHCP snooping is a separate switch feature that monitors DHCP conversations and records which IP address was legitimately assigned to which MAC address on which port. DAI piggybacks on this database. When a device received its IP through DHCP, the switch already knows the correct IP-to-MAC pairing. Any ARP packet claiming a different pairing gets flagged and discarded.
Trusted and Untrusted Ports
DAI assigns a trust state to every port on the switch. Ports marked as trusted are excluded from validation entirely, and all ARP traffic on those ports passes through without inspection. Ports marked as untrusted get the full treatment: every ARP packet is intercepted, validated against the snooping database, and dropped if it doesn’t check out.
In practice, you’d mark uplinks to other switches or routers as trusted, since those connections are under your control. End-user access ports, where an attacker could plug in a laptop, are left untrusted. This design means DAI focuses its inspection where the risk actually exists without adding overhead to infrastructure links.
Denial-of-Service Protection Through Rate Limiting
Because the switch CPU handles ARP inspection, a flood of ARP packets could overwhelm the processor and effectively take the switch offline. DAI addresses this with built-in rate limiting. By default, untrusted interfaces are capped at 15 ARP packets per second. If a port exceeds that threshold, the switch can shut the port down or log the violation. Trusted interfaces have no rate limit applied. This prevents an attacker from using a high volume of ARP traffic as a denial-of-service weapon against the switch itself.
Per-VLAN Deployment
DAI is enabled on a per-VLAN basis, not globally across the entire switch. This matters because ARP spoofing attacks are confined to a single Layer 2 broadcast domain (a VLAN). By enabling DAI on specific VLANs, you protect the ARP caches of every host within that VLAN. You can also keep DAI disabled on VLANs where it isn’t needed, reducing unnecessary processing. The recommendation is to separate VLANs with DAI enabled from those without, so protected segments stay fully isolated from unprotected ones.
Handling Static IP Addresses
DAI’s reliance on the DHCP snooping database creates an obvious question: what happens with devices that use static IP addresses and never go through DHCP? Since those devices won’t appear in the snooping database, DAI would drop their legitimate ARP packets by default.
The solution is ARP access control lists. You manually define the valid IP-to-MAC bindings for statically addressed devices, and DAI checks ARP packets against those entries instead. In environments where DHCP snooping is disabled entirely, these static ACLs become the sole reference for validation. This makes DAI viable even in networks that don’t use DHCP at all, though it does require upfront configuration for every static device.
Specific Attacks DAI Prevents
The core attack DAI neutralizes is ARP cache poisoning, but that single technique enables several downstream threats:
- Man-in-the-middle interception: An attacker positions themselves between two communicating devices by poisoning both of their ARP caches. They can then read unencrypted traffic, capture credentials, or modify data in transit.
- Session hijacking: By intercepting traffic between a user and a server, an attacker can steal session tokens and take over authenticated connections.
- Network disruption: An attacker can poison ARP caches with nonexistent MAC addresses, causing traffic to be sent to destinations that don’t exist. This effectively cuts off communication for targeted devices.
- Gateway impersonation: By claiming to be the default gateway, an attacker can intercept all traffic leaving the local network, giving them visibility into every outbound connection from affected hosts.
All of these attacks depend on the same underlying mechanism: getting a forged ARP entry accepted by other devices. DAI eliminates that step at the switch level, making the entire class of attack inoperable on protected VLANs.
What DAI Does Not Protect Against
DAI is specifically a Layer 2 defense for ARP traffic. It won’t help with attacks that don’t involve ARP manipulation. DNS spoofing, IP spoofing at Layer 3, attacks originating from outside the local network, and encrypted traffic interception through compromised certificates are all outside its scope. It also can’t protect traffic on VLANs where it hasn’t been enabled, and it relies on the accuracy of the DHCP snooping database or manually configured ACLs. If those references are incomplete or incorrect, legitimate traffic can be dropped while spoofed traffic on unmonitored VLANs passes through.