10.2.2.1.8. ARP Spoofing Attack / Spoofing Attack

An ARP spoofing attack (MITM) occurs when forged ARP messages are sent over the LAN. The attackers MAC address is then mapped to a computer's IP address. At this point, the attacker will start receiving any data for that IP address. ARP spoofing allows attackers to capture, modify and intercept data.

Dynamic ARP inspection (DAI) rejects invalid ARP packets. DAI is based on DHCP snooping because DHCP snooping creates a connection database with MAC address and IP addresses. The switch drops any ARP packet if the sending MAC address and sending IP address do not match the corresponding table entry in the DHCP snooping bindings database.

ip arp inspection vlan 444

ip arp inspection trust / ip arp inspection limit rate 2