ARP poisoning, also called ARP spoofing, is a man-in-the-middle attack on a local network. An attacker sends forged ARP replies that replace legitimate IP-to-MAC mappings, causing hosts to send frames to the attacker instead of to each other. The attacker can then intercept communications and potentially alter them. section 11.2.1 section 14.1
The attack follows the normal ARP learning process, then corrupts the resulting tables:
- PC1 broadcasts an ARP request for R1's MAC address; R1 replies, and both devices learn each other's IP-to-MAC mapping. section 14.1
- The attacker sends spoofed, often gratuitous, ARP replies claiming the attacker's MAC address belongs to PC1 and R1. section 14.1 section 14.3
- PC1 and R1 overwrite their legitimate entries and forward frames to the attacker, enabling interception of their communications. section 11.2.1
Dynamic ARP Inspection (DAI) protects Cisco switches against ARP-based attacks by inspecting and filtering ARP messages. It commonly uses the DHCP Snooping binding table, which maps DHCP-leased IP addresses to MAC addresses. Matching ARP messages are forwarded; messages without a matching entry are discarded. section 14.2 section 14.3
Configure and verify DAI with these Cisco IOS rules:
- Enable DAI for one or more VLANs globally: ip arp inspection vlan 1 or ip arp inspection vlan 2-5,7,9,2028. section 14.2
- Use ip arp inspection trust on ports connected to network infrastructure; leave end-host ports untrusted. section 14.3
- All ports are untrusted by default on a DAI-enabled switch, so untrusted-port ARP messages are inspected. section 14.3
- Verify VLAN status with show ip arp inspection and port trust state with show ip arp inspection interfaces. section 14.2 section 14.3
Basic DAI configuration
SW2(config)# ip dhcp snooping SW2(config)# ip dhcp snooping vlan 1 SW2(config)# ip arp inspection vlan 1 SW2(config)# interface g0/1 SW2(config-if)# ip dhcp snooping trust SW2(config-if)# ip arp inspection trust SW2(config)# do show ip arp inspection Vlan 1 Configuration Enabled Operation Active The configuration enables DAI on VLAN 1, trusts the infrastructure-facing interface, and confirms that DAI is enabled and active. section 14.2
Figure 14.2 An ARP poisoning attack. The attacker sends ARP replies to overwrite PC1 and R1’s ARP entries with the attacker’s own MAC address.
Use the attack diagram to trace how forged ARP replies replace PC1 and R1's entries with the attacker's MAC address. section 14.1
