DAI

What is DAI?

DAI (Dynamic ARP Inspection) is a security feature of managed switches that checks every ARP message arriving on an untrusted port against known IP-to-MAC bindings and discards forged messages, so an attacker cannot redirect or intercept traffic through ARP Spoofing. It works at Layer 2 and stops a Man-In-The-Middle attack at the switch port itself. This page is about practice: which settings matter, how you roll DAI out without losing production, and how you monitor it afterwards. The mechanism is covered in detail in the article on Dynamic ARP Inspection.

In OT networks, DAI protects for example PLC traffic from a rogue device or an unauthorised laptop posing as an HMI or controller.

🧠 What exactly does DAI do on a switch?

DAI is enabled per VLAN. From then on, the switch sends ARP packets that arrive on an untrusted port to its CPU and runs four steps:

1. Look up the sender - the IP and MAC address in the ARP message are looked up in an ARP access list (ARP ACL) and in the DHCP Snooping binding table.
2. ACL first - an ARP ACL takes precedence: if the ACL denies a packet, a valid DHCP binding no longer helps.
3. Forward or drop - if the binding matches, the packet is forwarded; if it does not, it is dropped and logged.
4. Watch the rate - if more ARP packets per second arrive than the configured limit, the switch shuts the port down (err-disable).

DAI only checks incoming traffic, and only on switches where the feature is enabled. Devices on a switch without DAI, or two devices behind the same unmanaged switch, are therefore not protected. If an operator plugs their own switch into an untrusted port, DAI does stop forged ARP messages entering through that port, but not ARP traffic between the devices behind that switch. Trusted ports, usually uplinks to other switches running DAI, are skipped.

🔧 Which settings determine how DAI behaves?

Commands differ per vendor, but the building blocks are similar everywhere. The table uses Cisco IOS syntax as an example, with the defaults of Catalyst switches.

The static keyword means only the ACL counts and the switch does not fall back on DHCP bindings. That is the usual choice in a cell where every controller has a fixed address. The rate limit can be set up to 2,048 packets per second; for trunks carrying many VLANs a higher limit or limit none is common.

🏭 How do you roll out DAI step by step in a production network?

In an office network, DAI is often simply switched on. In an OT network a wrong setting can stop a production line, so work in phases:

1. Inventory the addressing - record all IP-to-MAC bindings per VLAN from your asset inventory and check them against a passive capture in Wireshark. Watch out for devices with several network interfaces and for virtual IP addresses of redundant servers.
2. Check the switches - not every industrial switch or firmware version supports DAI. Where the feature is missing, other measures remain necessary.
3. Build the ARP ACLs - one entry per statically addressed device. Enable DHCP Snooping on VLANs that do use DHCP and store the binding table persistently.
4. Measure normal ARP volume - look especially at start-up bursts from PLCs and HMIs and at trunks, and set the rate limit well above the measured maximum.
5. Test in a test environment or maintenance window - enable DAI on one VLAN first, check the counters and let the cell go through a complete start-up.
6. Extend zone by zone - then add the next cell and record every step in your change management process.

From then on, every replaced network card or PLC means a new MAC address and therefore an updated ACL. Include that step in the work instruction for breakdown replacement, otherwise DAI blocks the new device at exactly the moment the plant needs to run again.

📊 How do you verify and monitor DAI after rollout?

DAI only adds value if someone sees its alerts. Forward log entries via Syslog to your SIEM or network monitoring, and log denied packets rather than all permitted ones: the latter quickly produces hundreds of entries per second.

On Cisco switches, show ip arp inspection statistics and show ip arp inspection interfaces show the counters and port states, and show ip dhcp snooping binding shows the binding table. A sudden series of drops on a port in a zone with controllers deserves the same attention as an alert from an IDS or NDR sensor.

🔄 How does DAI differ between vendors?

The principle is the same, but the defaults are not. If your network mixes switch brands, you need to know the differences.

Juniper also does not inspect ARP probes, the messages a device uses to check whether an address is already in use. Other vendors, including makers of industrial switches, sometimes use different names for the same function. Check the manual for each model and firmware version.

🔐 How does DAI fit IEC 62443 and the NIS2 rules?

IEC 62443 does not name DAI, but the feature contributes to system requirements in IEC 62443-3-3, mainly SR 3.1 (communication integrity) within a zone. Network segmentation (SR 5.1) and firewalls control traffic between zones; DAI protects traffic inside a zone, where a firewall sees nothing.

For organisations covered by NIS2, the Dutch Cybersecurity Act (Cyberbeveiligingswet) has applied since 15 August 2026, with a duty of care for appropriate technical measures. DAI is not a requirement in itself, but it is a cheap and verifiable measure you can demonstrate in an audit with configuration and log entries. Together with IP Source Guard, Port Security and 802.1X it forms one layer of defence in depth.

❓ Frequently asked questions

What does the abbreviation DAI stand for?

DAI stands for Dynamic ARP Inspection, a feature of managed switches that checks ARP messages for forged IP-to-MAC bindings. DAI thereby prevents ARP poisoning and man-in-the-middle attacks at Layer 2. The feature is available on many managed switches for IT and OT.

Does DAI affect network performance?

DAI only inspects ARP traffic, so ordinary process data such as Modbus TCP passes without extra delay. The switch CPU does process all ARP packets on untrusted ports, which is why the rate limit exists. At normal ARP volumes you will not notice DAI in practice.

What happens when a PLC is replaced while DAI is enabled?

A new PLC usually has a different MAC address, so DAI denies its ARP messages if the ARP ACL still holds the old address. The PLC then becomes unreachable for the HMI and SCADA. Include updating the DAI configuration in your breakdown replacement procedure.

Should DAI be enabled on uplinks between switches?

Uplinks between switches that run DAI are usually set as trusted, so every ARP packet is checked once at the edge. An uplink to a switch without DAI is better kept untrusted, with a generous rate limit. Otherwise an attacker on that switch can send unchecked ARP messages into the network.

Can DAI detect ARP attacks without blocking them?

That depends on the switch, but on many implementations, such as Cisco Catalyst, an ARP message that does not match is dropped straight away. A safe way to start is to enable DAI on a test VLAN or during a maintenance window first and review the counters and logs. For pure detection without intervention, a passive security monitoring solution is more suitable.

Is DAI worthwhile if the OT network is already segmented?

Yes, DAI remains worthwhile, because segmentation controls traffic between zones, not within a zone. ARP spoofing happens inside a single VLAN, for example between a PLC, an HMI and a Historian. DAI and segmentation therefore complement each other.

📌 In summary

DAI lets a managed switch check ARP messages on untrusted ports against DHCP Snooping bindings or ARP ACLs and drop forged messages. In OT this calls for a careful rollout: inventory fixed addresses, build ACLs, tune the rate limit to measured traffic and extend zone by zone. After that, logging, monitoring and change management make the difference between working security and an unexpected outage.

DAI stops ARP spoofing at the switch port and protects OT communication within a zone, provided you manage static bindings, limits and logging as carefully as the control system itself.