ARP resolves an IPv4 address to a MAC address on a local network. An ARP message is carried directly inside an Ethernet frame, without an IP header; its own fields identify sender and target addresses. section 14.1
A standard ARP exchange proceeds as follows:
- The requesting host broadcasts an ARP request. The Target IP identifies the intended recipient, while the unknown Target MAC is empty. section 14.1
- The recipient learns the requester’s IP-to-MAC mapping from the request’s Sender IP and Sender MAC fields. section 14.1
- The recipient sends an ARP reply, allowing the requester to learn the recipient’s MAC address and complete both ARP table entries. section 14.1
ARP poisoning
An attacker sends gratuitous ARP replies that overwrite legitimate ARP entries with the attacker’s MAC address. The affected hosts then send frames to the attacker, exposing their communications. section 14.1
Cisco Dynamic ARP Inspection (DAI) mitigates ARP poisoning by inspecting ARP messages on untrusted ports and comparing Sender IP and Sender MAC against the DHCP Snooping binding table. Enable it with ip arp inspection vlan vlans; trust infrastructure-facing interfaces with ip arp inspection trust; verify with show ip arp inspection and show ip arp inspection interfaces. Ports are untrusted by default, and unmatched ARP messages are discarded. section 14.2.1 section 14.3
