In which configuration mode is show ip arp inspection used?

The show ip arp inspection command is entered in Privileged EXEC mode on Cisco IOS devices.

SecurityPrivileged EXEC

show ip arp inspection

Displays the Dynamic ARP Inspection (DAI) statistics and configuration status on a switch, used to verify DAI operation and troubleshoot ARP spoofing attacks.

Definition: show ip arp inspection is a Cisco IOS privileged exec command. Displays the Dynamic ARP Inspection (DAI) statistics and configuration status on a switch, used to verify DAI operation and troubleshoot ARP spoofing attacks.

Overview

The `show ip arp inspection` command is a vital diagnostic tool for network engineers working with Dynamic ARP Inspection (DAI) on Cisco switches. DAI is a security feature that protects against ARP spoofing and ARP cache poisoning attacks by intercepting all ARP packets on untrusted ports and validating them against a trusted database—typically the DHCP snooping binding table. This command displays the operational status of DAI, including the number of ARP packets processed, dropped, and the configured trust states for VLANs and interfaces.

It is essential for verifying that DAI is functioning correctly after configuration and for troubleshooting issues such as connectivity problems caused by false positives (legitimate ARP packets being dropped) or security breaches where spoofed ARP packets are not being filtered. Unlike `show ip arp inspection interfaces`, which focuses on per-interface trust settings, or `show ip arp inspection vlan`, which shows per-VLAN statistics, the base command provides a global summary. It is typically used in the workflow after enabling DAI globally and on VLANs, and after configuring DHCP snooping (which populates the binding table).

The command runs in privileged EXEC mode (enable) and does not require any additional privilege levels. Its output is buffered and can be captured for analysis. It does not affect the running configuration; it is purely a show command.

Understanding its output is critical for CCNA and CCNP candidates, as DAI is a common topic in security exams and real-world network hardening.

Syntax·Privileged EXEC

show ip arp inspection

When to Use This Command

Verify that DAI is enabled on specific VLANs after configuration.
Check the number of ARP packets dropped due to invalid IP-to-MAC bindings.
Monitor DAI statistics to detect potential ARP spoofing attacks in the network.
Troubleshoot connectivity issues caused by DAI blocking legitimate ARP traffic.

Parameters

Parameter	Syntax	Required	Description
vlan {vlan-id}	vlan <1-4094>	Optional	Displays DAI statistics and configuration for a specific VLAN. Valid values are VLAN IDs from 1 to 4094. Common mistake: using a VLAN that does not exist or is not configured for DAI, which results in no output.
interface {interface-id}	interface <interface-type> <interface-number>	Optional	Displays DAI statistics and trust state for a specific interface. The interface must be a switch port (e.g., GigabitEthernet0/1). Common mistake: specifying a routed port or SVI, which does not support DAI.
statistics	statistics	Optional	Displays detailed DAI packet counters, including the number of ARP requests, replies, and drops. This is useful for troubleshooting packet validation issues. Common mistake: forgetting to clear counters before testing, leading to misleading historical data.
acl-statistics	acl-statistics	Optional	Displays DAI ACL-based packet statistics, showing how many packets matched each configured ARP ACL. Common mistake: assuming ACL statistics are available without first configuring an ARP ACL for DAI validation.
logging	logging	Optional	Displays the DAI logging configuration, including the logging buffer size and whether logging of dropped packets is enabled. Common mistake: expecting to see log entries immediately; logging is rate-limited by default.

Command Examples

Basic DAI status and statistics

show ip arp inspection

Source Mac Validation      : Disabled
Destination Mac Validation : Disabled
IP Address Validation      : Disabled

 Vlan     Configuration    Operation   ACL Match          Static ACL
 ----     -------------    ---------   ---------          ----------
   1     Enabled           Active      arp-acl-1          arp-acl-1
  10     Disabled          Inactive

 Vlan     ACL Logging      DHCP Logging
 ----     ---------------  -------------
   1     Deny             Deny
  10     Deny             Deny

 Vlan     Forwarded        Dropped     DHCP Drops         ACL Drops
 ----     ----------       --------    ----------         ---------
   1      1500             23          20                 3
  10      0                0           0                  0

 Vlan     DHCP Permits     ACL Permits  Source MAC Failures
 ----     --------------   -----------  -------------------
   1      1480             20           2
  10      0                0            0

 Vlan     Dest MAC Failures  IP Validation Failures  Invalid Protocol
 ----     -----------------  ----------------------  ----------------
   1      0                  1                       0
  10      0                  0                       0

The output shows DAI configuration and statistics per VLAN. 'Source Mac Validation', 'Destination Mac Validation', and 'IP Address Validation' indicate whether these checks are enabled globally. The 'Vlan' table shows per-VLAN configuration and operation status. 'ACL Match' and 'Static ACL' show the ACLs applied. 'Forwarded' and 'Dropped' columns show packet counts. 'DHCP Drops' and 'ACL Drops' break down drop reasons. 'Source MAC Failures', 'Dest MAC Failures', 'IP Validation Failures', and 'Invalid Protocol' show specific validation failures.

Detailed DAI statistics with interface breakdown

show ip arp inspection interfaces

Interface        Trust State     Rate (pps)    Burst Interval
---------        -----------     ----------    --------------
Gi1/0/1          Trusted         15            1
Gi1/0/2          Untrusted       5             1
Gi1/0/3          Untrusted       10            1

Interface        DHCP Drops      ACL Drops      Source MAC Failures
---------        ----------      ---------      -------------------
Gi1/0/1          0               0              0
Gi1/0/2          20              3              2
Gi1/0/3          0               0              0

Interface        Dest MAC Failures  IP Validation Failures  Invalid Protocol
---------        -----------------  ----------------------  ----------------
Gi1/0/1          0                  0                       0
Gi1/0/2          0                  1                       0
Gi1/0/3          0                  0                       0

This output shows per-interface DAI statistics. 'Trust State' indicates whether the interface is trusted (DAI bypassed) or untrusted (DAI enforced). 'Rate' and 'Burst Interval' show the ARP rate limiting parameters. The subsequent tables show drop counts per interface for various validation failures. High drop counts on an untrusted interface may indicate an ARP spoofing attack or misconfiguration.

Understanding the Output

The 'show ip arp inspection' command output is divided into sections. The first section shows global validation settings (Source MAC, Destination MAC, IP Address Validation) which are typically disabled unless explicitly configured. The second section lists VLANs with their DAI configuration status ('Enabled' or 'Disabled') and operation status ('Active' or 'Inactive').

'ACL Match' and 'Static ACL' columns show the ACLs applied for ARP packet filtering. The third section shows ACL and DHCP logging settings per VLAN. The fourth section provides packet counters: 'Forwarded' (legitimate ARP packets), 'Dropped' (total drops), 'DHCP Drops' (dropped due to DHCP snooping binding mismatch), and 'ACL Drops' (dropped by ACL).

The fifth section shows 'DHCP Permits' and 'ACL Permits' (packets allowed by each mechanism). The final sections break down validation failures: 'Source MAC Failures' (source MAC mismatch), 'Dest MAC Failures' (destination MAC mismatch), 'IP Validation Failures' (IP address mismatch), and 'Invalid Protocol' (non-ARP packets). In a healthy network, drop counts should be low or zero; a sudden spike in drops on untrusted interfaces may indicate an ARP spoofing attack.

Trusted interfaces (e.g., uplinks to routers) should have zero drops as DAI is bypassed.

Configuration Scenarios

Verifying DAI Operation on a Single VLAN

After configuring DAI on VLAN 10 to protect against ARP spoofing, the network engineer needs to confirm that DAI is active and that ARP packets are being validated correctly.

Topology

Switch1(Gi0/1)---PC1 (10.0.10.10/24)
Switch1(Gi0/2)---PC2 (10.0.10.20/24)
Both ports are untrusted; DHCP snooping is enabled on VLAN 10.

Steps

1.Step 1: Enter privileged EXEC mode: Switch> enable
2.Step 2: Display global DAI status: Switch# show ip arp inspection
3.Step 3: Display per-VLAN statistics: Switch# show ip arp inspection vlan 10
4.Step 4: Display interface trust states: Switch# show ip arp inspection interfaces

Configuration

! DAI configuration on VLAN 10
Switch(config)# ip arp inspection vlan 10
Switch(config)# interface gigabitethernet0/1
Switch(config-if)# ip arp inspection trust
! Note: Typically, ports connecting to hosts are untrusted (default), and ports connecting to routers or other switches are trusted.

Verify: Switch# show ip arp inspection vlan 10 Source Mac Validation : Enabled Destination Mac Validation : Disabled IP Address Validation : Disabled Vlan Configuration Operation ACL Match Static ACL ---- ------------- --------- --------- ---------- 10 Enabled Active Vlan ACL Logging DHCP Logging ---- --------------- ------------- 10 Deny Deny

Watch out: A common mistake is forgetting to enable DHCP snooping on the VLAN; DAI relies on the DHCP snooping binding table for validation. Without DHCP snooping, DAI will drop all ARP packets from untrusted ports.

Troubleshooting ARP Packet Drops Due to Invalid MAC-IP Bindings

Users on VLAN 20 report intermittent connectivity issues. The engineer suspects DAI is dropping legitimate ARP packets because the DHCP snooping binding table is outdated or incomplete.

Topology

Switch2(Gi0/1)---HostA (static IP 192.168.20.50/24)
Switch2(Gi0/2)---HostB (DHCP client)
DHCP snooping is enabled on VLAN 20.

Steps

1.Step 1: Check DAI drop counters: Switch# show ip arp inspection statistics
2.Step 2: Examine the DHCP snooping binding table: Switch# show ip dhcp snooping binding
3.Step 3: Verify the ARP ACL if used: Switch# show ip arp inspection acl-statistics
4.Step 4: Check the logging buffer for dropped packets: Switch# show ip arp inspection logging

Configuration

! DAI configuration with validation
Switch(config)# ip arp inspection vlan 20
Switch(config)# ip arp inspection validate src-mac dst-mac ip
! This enables validation of source MAC, destination MAC, and IP address.

Verify: Switch# show ip arp inspection statistics Vlan 20: ARP requests: 150 ARP replies: 200 Drops: 25 DHCP Drops: 20 ACL Drops: 5 Invalid source MAC: 10 Invalid destination MAC: 5 Invalid IP: 10 If drops are high, check the DHCP snooping binding table for missing entries.

Watch out: A common mistake is enabling all validations (src-mac, dst-mac, ip) without ensuring that all devices have consistent MAC and IP addresses in the binding table. Static hosts must have a static DHCP snooping binding entry or be placed on a trusted port.

Troubleshooting with This Command

When troubleshooting DAI issues, the `show ip arp inspection` command is your first stop. A healthy output shows that DAI is enabled on the desired VLANs and that the operation status is 'Active'. The statistics section should show a low drop count relative to the total ARP packets.

If you see high drop counts, focus on the 'Drops' field and its subcategories: 'DHCP Drops' indicate that the source IP-MAC pair is not found in the DHCP snooping binding table; 'ACL Drops' indicate that the packet did not match any ARP ACL; 'Invalid source MAC' or 'Invalid destination MAC' indicate a mismatch between the Ethernet MAC and the ARP MAC; 'Invalid IP' indicates an IP address mismatch (e.g., source IP in ARP does not match the expected IP from the binding table). A step-by-step diagnostic flow: 1) Run `show ip arp inspection` to confirm DAI is enabled and active on the VLAN. 2) Run `show ip arp inspection statistics` to identify the type of drops. 3) If DHCP Drops are high, check `show ip dhcp snooping binding` to see if the device's MAC and IP are present. If not, ensure DHCP snooping is enabled on the VLAN and that the device is using DHCP.

For static IPs, either configure a static DHCP snooping binding (`ip dhcp snooping binding <mac> vlan <vlan> <ip> interface <int>`) or trust the port. 4) If ACL Drops are high, review the ARP ACL configuration with `show ip arp inspection acl-statistics` and ensure the ACL permits the necessary ARP packets. 5) If Invalid MAC/IP drops are high, verify that the device's actual MAC and IP match what is in the binding table. This can happen after a NIC replacement or IP change. Correlate with `debug ip arp inspection` (use with caution in production) to see real-time validation decisions.

Also, check `show logging` for DAI log messages if logging is enabled. Remember that DAI only validates ARP packets on untrusted ports; if a port is trusted, all ARP packets are forwarded without validation. Use `show interfaces <interface> | include arp inspection` to verify trust state.

In summary, the key fields to watch are the drop counters and the trust state of interfaces.

CCNA Exam Tips

Remember that DAI relies on DHCP snooping bindings; if DHCP snooping is not enabled, DAI will drop all ARP packets on untrusted ports unless an ACL is configured.

DAI validates ARP packets based on MAC address and IP address bindings; the exam may test which validation checks are enabled by default (none).

Trusted ports bypass DAI; typically configure ports connecting to routers or other switches as trusted.

The 'show ip arp inspection interfaces' command is useful for identifying which interface is dropping ARP packets.

Common Mistakes

Forgetting to enable DHCP snooping before DAI, causing all ARP packets to be dropped on untrusted ports.

Configuring DAI on a VLAN but not applying an ACL, resulting in all ARP packets being dropped if DHCP snooping is not available.

Setting all ports as trusted, which defeats the purpose of DAI and leaves the network vulnerable to ARP spoofing.

show ip arp inspection vs show ip dhcp snooping

Both 'show ip arp inspection' and 'show ip dhcp snooping' are security-related troubleshooting commands on Cisco switches, often used together to protect against spoofing attacks. They are commonly confused because DHCP snooping is a prerequisite for Dynamic ARP Inspection (DAI), and both involve validation of binding tables. Understanding their distinct outputs helps isolate DHCP vs. ARP-related issues.

Aspect	show ip arp inspection	show ip dhcp snooping
Scope	Displays DAI statistics, VLAN configuration, and inspection validation results	Displays DHCP snooping binding database, statistics, and trust settings
Configuration prerequisites	Requires DHCP snooping to be enabled globally and per VLAN	Enabled globally and per VLAN; no dependency on DAI
Data sources	Validates ARP packets against DHCP snooping bindings or ARP ACLs	Builds a binding table from DHCP server responses
Persistence	Shows real-time inspection counters; binding data is derived from DHCP snooping	Binding database is stored in memory and can be exported/imported
Typical use	Verify DAI operation, check for invalid ARP packets, identify spoofing attacks	Verify DHCP bindings, detect rogue DHCP servers, confirm trust configuration

Use show ip arp inspection when troubleshooting ARP spoofing attacks or verifying that DAI is correctly validating ARP replies against the DHCP snooping database.

Use show ip dhcp snooping when troubleshooting DHCP assignment issues, verifying client bindings, or identifying unauthorized DHCP servers on the network.

Platform Notes

In IOS-XE (e.g., Catalyst 3650/9300), the `show ip arp inspection` command syntax and output are very similar to classic IOS. However, IOS-XE may include additional fields such as 'VLAN Configuration' and 'Operation' status. The command is available in privileged EXEC mode.

In NX-OS (e.g., Nexus 9000), the equivalent command is `show ip arp inspection` as well, but the output format differs slightly; it displays per-VLAN statistics and trust states. NX-OS also supports `show ip arp inspection statistics` and `show ip arp inspection interface`. There is no direct ASA equivalent because DAI is a switch feature; ASA uses ARP inspection in the context of firewall features like ARP spoofing detection, but the command is different (`show arp inspection`).

In IOS-XR (e.g., ASR 9000), DAI is not supported; instead, similar functionality is achieved through other security features like IP Source Guard. Between IOS versions, the command has remained largely consistent from 12.x to 16.x, but newer versions may show additional validation options (e.g., `ip arp inspection validate allow-zeros`). Always check the specific platform documentation for exact syntax.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions