ARP Spoofing vs. Dynamic ARP Inspection

Attacker (untrusted port)

Forged reply interval 2.0s

Switch defense

Client's ARP cache

gateway 10.0.0.1 → aa:11 (real gateway)

Traffic path: direct to gateway

Live counters

Data packets intercepted

0 / 0

Forged ARP blocked by DAI

Event log

How it works

ARP (Address Resolution Protocol) maps an IP address to the MAC address a switch actually forwards frames to. It has no authentication: any host on the segment can broadcast a reply claiming "IP X is at my MAC", and — because ARP is stateless — the last reply a host hears simply overwrites its cache entry.

Client wants 10.0.0.1 (gateway)
  → cache lookup: 10.0.0.1 = MAC?
Attacker sends unsolicited (gratuitous) reply:
  "10.0.0.1 is at AA:ATTACKER" — never verified
Client's cache silently overwrites the real binding.
All frames to 10.0.0.1 now carry dest-MAC = attacker,
and the switch — correctly, by design — delivers them
to the attacker's own port. This is the whole exploit:
the switch is doing exactly what MAC-based forwarding
is supposed to do; only the cache entry lied.

Dynamic ARP Inspection (DAI) closes this hole at the switch, not the host. Every untrusted port already has a DHCP-snooping binding table — {IP, MAC, VLAN, port} tuples the switch itself recorded when each host leased its address. DAI checks every inbound ARP packet against that table before it is ever forwarded:

on ARP packet at port P claiming (IP, MAC):
  if bindingTable[IP] == (MAC, P): forward
  else: drop at ingress, log violation

Start ARP Spoofing — the attacker begins broadcasting forged gateway-IP replies at the interval set below.
Forged reply interval — how often the attacker re-asserts the lie; a real gratuitous-ARP flood runs continuously to beat the legitimate gateway's own refresh replies.
Enable Dynamic ARP Inspection — the switch now validates every reply's (IP, MAC, port) triple against its DHCP-snooping bindings; the attacker's forged packets never even reach the client, so the cache stays correct and traffic keeps flowing straight to the gateway.

Real-world relevance: this is exactly the mechanism behind on-path (man-in-the-middle) attacks on switched LANs, and DAI — paired with DHCP snooping — is the standard enterprise switch feature (Cisco Catalyst, Aruba, Juniper) that neutralizes it without touching a single endpoint.

Client Gateway Attacker Switch / idle hosts

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.