ARP (Address Resolution Protocol) maps an IP address to the MAC address a switch actually forwards frames to. It has no authentication: any host on the segment can broadcast a reply claiming "IP X is at my MAC", and — because ARP is stateless — the last reply a host hears simply overwrites its cache entry.
Client wants 10.0.0.1 (gateway)
→ cache lookup: 10.0.0.1 = MAC?
Attacker sends unsolicited (gratuitous) reply:
"10.0.0.1 is at AA:ATTACKER" — never verified
Client's cache silently overwrites the real binding.
All frames to 10.0.0.1 now carry dest-MAC = attacker,
and the switch — correctly, by design — delivers them
to the attacker's own port. This is the whole exploit:
the switch is doing exactly what MAC-based forwarding
is supposed to do; only the cache entry lied.
Dynamic ARP Inspection (DAI) closes this hole at the switch, not the host. Every untrusted port already has a DHCP-snooping binding table — {IP, MAC, VLAN, port} tuples the switch itself recorded when each host leased its address. DAI checks every inbound ARP packet against that table before it is ever forwarded:
on ARP packet at port P claiming (IP, MAC):
if bindingTable[IP] == (MAC, P): forward
else: drop at ingress, log violation
This 2D version renders the same event-driven model as a scrolling sequence diagram: four vertical swimlanes (Client, Switch, Gateway, Attacker) with time flowing downward. Every ARP reply and data packet is an arrow crossing from one lane to another at the moment it fires; a DAI-blocked reply stops dead at the Switch lane and never reaches Client. The narrow strip on the left is a scrolling EKG-style trace of the cache state itself (green = bound to the real gateway, red = poisoned) so you can read exactly how long each poisoning window lasts and how quickly DAI collapses it to zero.
- Start ARP Spoofing — the attacker begins broadcasting forged gateway-IP replies at the interval set below.
- Forged reply interval — how often the attacker re-asserts the lie; a real gratuitous-ARP flood runs continuously to beat the legitimate gateway's own refresh replies.
- Data traffic interval — how often the client sends an ordinary data packet toward the gateway; this is what gets silently detoured through the attacker while poisoned.
- Gateway refresh interval — how often the real gateway re-asserts its own binding, which restores the cache until the attacker poisons it again.
- Playback speed — scales simulated time without changing any interval's real-world meaning, useful for watching a long poisoning/restore cycle quickly or a fast one in slow motion.
- Enable Dynamic ARP Inspection — the switch now validates every reply's (IP, MAC, port) triple against its DHCP-snooping bindings; forged arrows stop at the Switch lane, the cache stays correct and traffic keeps flowing straight to the gateway.
Real-world relevance: this is exactly the mechanism behind on-path (man-in-the-middle) attacks on switched LANs, and DAI — paired with DHCP snooping — is the standard enterprise switch feature (Cisco Catalyst, Aruba, Juniper) that neutralizes it without touching a single endpoint.