Contents
What is dynamic ARP inspection Dai?
Dynamic ARP Inspection (DAI) is a security feature that validates Address Resolution Protocol (ARP) packets in a network. DAI allows a network administrator to intercept, log, and discard ARP packets with invalid MAC address to IP address bindings.
On which port should dynamic ARP inspection be configured on a switch?
On which port should Dynamic ARP Inspection (DAI) be configured on a switch? Answers Explanation & Hints: DHCP snooping must be enabled on a port where DAI is configured, because DAI requires the DHCP snooping table to operate.
What does dynamic ARP inspection ( Dai ) Do?
Dynamic ARP Inspection (DAI) is a security feature that validates Address Resolution Protocol (ARP) packets in a network. DAI allows a network administrator to intercept, log, and discard ARP packets with invalid MAC-IP pairs. This capability protects the network from certain “man-in-the-middle” attacks.
How does Dai determine validity of ARP packet?
DAI can determine the validity of an ARP packet based on valid IP-to-MAC address bindings stored in a Dynamic Host Configuration Protocol (DHCP) snooping binding database. This database is built by DHCP snooping if DHCP snooping is enabled on the VLANs and on the device.
How does Dai prevent attacks on ARP cache?
DAI prevents these attacks by intercepting all ARP requests and responses. Each of these intercepted packets is verified for valid MAC address to IP address bindings before the local ARP cache is updated or the packet is forwarded to the appropriate destination.
How does dynamic ARP inspection work on VLANs?
This database is built by DHCP snooping if DHCP snooping is enabled on the VLANs and on the device. It can also contain static entries that you create. If the ARP packet is received on a trusted interface, the device forwards the packet without any checks. On untrusted interfaces, the device forwards the packet only if it is valid.