Also known as: DAI, ARP inspection
Quick Definition
A switch security feature that validates ARP packets using the DHCP Snooping binding table to prevent ARP spoofing.
DAI intercepts ARP requests and replies on untrusted ports and validates them against the DHCP Snooping binding table. If an ARP message contains a MAC-to-IP mapping not in the binding table, DAI drops the frame. This prevents ARP spoofing attacks where a malicious host sends fake ARP replies to redirect traffic through itself (man-in-the-middle). DAI depends on DHCP Snooping being enabled first to build the binding table.
ip arp inspection vlan 10 interface GigabitEthernet0/1 ip arp inspection trust ! uplink — trusted
DAI requires DHCP Snooping to be configured first. For hosts with static IP addresses (no DHCP), you must add manual ARP access-list entries, otherwise DAI drops all their ARP messages.
DAI intercepts ARP requests and replies on untrusted ports and validates them against the DHCP Snooping binding table. If an ARP message contains a MAC-to-IP mapping not in the binding table, DAI drops the frame. This prevents ARP spoofing attacks where a malicious host sends fake ARP replies to redirect traffic through itself (man-in-the-middle). DAI depends on DHCP Snooping being enabled first to build the binding table.
DAI requires DHCP Snooping to be configured first. For hosts with static IP addresses (no DHCP), you must add manual ARP access-list entries, otherwise DAI drops all their ARP messages.
Dynamic ARP Inspection falls under the Security domain of the 200-301 exam. Understanding it in context with related terms like dhcp-snooping and arp is essential for answering scenario-based questions correctly.