Why ARP is vulnerable
ARP translates a next-hop IPv4 address to a link address but has no built-in identity proof. Forged advertisements can replace a gateway mapping and divert traffic. Attacks require an applicable local segment context; do not assume any remote Internet host can directly poison every internal ARP table.
Evidence before conclusions
Inspect neighbor mappings, trusted DHCP bindings, switch port observations and time-correlated traffic. A changed MAC can also reflect a legitimate gateway failover. Preserve a capture and distinguish observed inconsistent mapping from a confirmed attacker. Synthetic examples in ITAV never send real forged traffic.
Layer-2 defensive controls
DHCP snooping can build address/port bindings while rejecting server messages on untrusted ports. Dynamic ARP Inspection checks appropriate ARP claims against trusted information. Static endpoints require planned bindings or equivalent policy. Misconfigured trust can disrupt legitimate clients, so deploy and verify carefully.
Defense in depth
Segmentation limits exposure, encrypted authenticated sessions reduce content interception and monitoring improves detection. TLS does not repair the L2 mapping and trusted-root mistakes can undermine endpoint authentication. Combine controls with operational evidence and change management.
Signal / protocol flow
- 1ARP claim
- 2Trusted binding
- 3Port validation
- 4Accept or drop
- 5Neighbor delivery
Technical terminology
- ARP cache: neighbor mapping
- MITM: intermediary positioning
- DAI: dynamic ARP inspection
- Binding: address/MAC/port association
Worked example
Known gateway 10.0.0.1→AA on uplink; edge port advertises 10.0.0.1→BB. Compare against authorized failover events and bindings. Under the lesson’s accurate DAI policy the inconsistent claim is rejected.
Configuration reference
! Platform-specific Cisco reference; review deployment requirements ip dhcp snooping ip dhcp snooping vlan 10 ip arp inspection vlan 10 ! Trust only the intended server/uplink path, not every edge port.
Troubleshooting scenario
After enabling inspection, statically addressed AV devices lose connectivity. Check missing authorized bindings and trust policy rather than disabling every protection globally.
Knowledge check
Does a valid ARP reply authenticate the sender?
Related practice
References
Educational model — not real hardware, traffic or official certification.