PlantUML DiagramARP Spoofing Attack
A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
The gateway IP (10.10.10.1) alternating between two different MACs every few minutes. That's ARP poisoning. Two devices are claiming the same IP with different MACs. Without defense, whichever ARP reply arrives last wins the cache — hosts send their traffic to the attacker instead of the real gateway.
ARP has no authentication. When a host ARPs for the gateway, it accepts the first reply. An attacker can send unsolicited ARP replies — 'I am 10.10.10.1, my MAC is XX:XX:XX:XX:XX:XX' — to every host on the segment. Hosts update their ARP caches with the attacker's MAC. Now all traffic destined for the gateway flows through the attacker, who can inspect, modify, or drop it.
ARP spoofing is a classic attack because it's trivial and effective. Free tools (arpspoof, ettercap) automate it. Every network with user-accessible ports should have DAI enabled on those ports. Combined with DHCP snooping, it turns an open LAN into one where ARP entries are validated against a trusted source.
! Prerequisite — DHCP snooping must be enabledSW1(config)# ip dhcp snoopingSW1(config)# ip dhcp snooping vlan 10,20,30! Enable DAI on those VLANsSW1(config)# ip arp inspection vlan 10,20,30! Trust uplinks (where legitimate ARP traffic from other switches arrives)SW1(config)# interface gigabitEthernet0/24SW1(config-if)# ip arp inspection trustSW1(config-if)# exit! Validate source MAC, destination MAC, and IP against the snooping bindingSW1(config)# ip arp inspection validate src-mac dst-mac ip! VerifySW1# show ip arp inspectionSW1# show ip arp inspection statistics
DAI checks every ARP packet against the DHCP snooping binding table. If a host sends an ARP claiming to be an IP it doesn't own — the packet is dropped. If the MAC-to-IP mapping isn't in the binding table — dropped. The `validate` command adds additional checks: source MAC must match Ethernet source, destination MAC must match Ethernet destination, and IP addresses in the ARP body must be valid.
DAI's default operation is to drop ARP packets that don't match the DHCP snooping binding table. That's fine for DHCP clients. But servers and other statically-addressed hosts don't have DHCP bindings — their ARP packets get dropped, breaking connectivity. The fix: ARP ACLs.
! Create an ARP ACL for static hostsSW1(config)# arp access-list STATIC_HOSTSSW1(config-arp-nacl)# permit ip host 10.10.10.50 mac host 0050.7966.6800SW1(config-arp-nacl)# permit ip host 10.10.10.51 mac host 0050.7966.6801SW1(config-arp-nacl)# exit! Apply to DAI on the relevant VLANsSW1(config)# ip arp inspection filter STATIC_HOSTS vlan 10! Or allow statically via ip source bindingSW1(config)# ip source binding 0050.7966.6800 vlan 10 10.10.10.50 interface gi0/5! VerifySW1# show ip arp inspection
ARP ACLs list the permitted IP-to-MAC mappings for static hosts. `ip source binding` is the more modern approach — it adds static entries directly to the snooping binding table, so DAI sees them like DHCP entries. Both work; source binding is cleaner for large numbers of static hosts.
Finish the lesson once you have worked through the material. This awards ★ 30 XP.