What does Dynamic ARP Inspection (DAI) protect against?

What does Dynamic ARP Inspection (DAI) protect against?

• A. ARP packet spoofing
• B. IP spoofing
• C. DNS spoofing
• D. MAC flooding

Answer: (A)

Dynamic ARP Inspection focuses on the trustworthiness of ARP traffic. It validates ARP replies against a binding table built from DHCP snooping, ensuring that the IP-to-MAC mappings really belong to the devices that DHCP learned them from. If an ARP reply on an untrusted port doesn’t match the known binding, DAI drops it. This blocks ARP spoofing, where an attacker tries to associate their MAC with someone else’s IP (like the gateway) to intercept or misdirect traffic. In short, it protects against ARP packet spoofing by enforcing legitimate IP-to-MAC mappings. It won’t directly stop IP spoofing, DNS spoofing, or MAC flooding, which involve different attack vectors and defenses.

Dynamic ARP Inspection focuses on the trustworthiness of ARP traffic. It validates ARP replies against a binding table built from DHCP snooping, ensuring that the IP-to-MAC mappings really belong to the devices that DHCP learned them from. If an ARP reply on an untrusted port doesn’t match the known binding, DAI drops it. This blocks ARP spoofing, where an attacker tries to associate their MAC with someone else’s IP (like the gateway) to intercept or misdirect traffic. In short, it protects against ARP packet spoofing by enforcing legitimate IP-to-MAC mappings. It won’t directly stop IP spoofing, DNS spoofing, or MAC flooding, which involve different attack vectors and defenses.