Dynamic ARP Inspection

What is Dynamic ARP Inspection?

Dynamic ARP Inspection (DAI) is a security feature of managed switches that checks every ARP message arriving on an untrusted port against a table of known IP-to-MAC bindings and discards forged messages, so an attacker cannot redirect traffic through ARP poisoning. DAI takes those bindings from the DHCP Snooping binding table or from manually configured ARP access lists. The switch thereby stops a Layer 2 Man-In-The-Middle attack at the port, before the ARP cache of a PLC, SCADA server or Historian is poisoned.

🧠 Why does ARP need protection?

ARP (Address Resolution Protocol) was defined in RFC 826 in 1982 and maps an IPv4 address to the MAC address of a device in the same VLAN. The protocol has no authentication whatsoever. Any device may send an ARP reply, even without a preceding request (a gratuitous ARP), and the receiver usually just updates its ARP cache.

That makes Spoofing easy:

• Redirecting traffic - an attacker, for example with an unknown laptop on a spare switch port, announces that the PLC’s IP address belongs to their own MAC address and from then on receives the traffic from the HMI.
• Eavesdropping and tampering - sitting in the middle, the attacker can silently alter Modbus TCP commands or measured values, or carry out session hijacking.
• Causing outages - a wrong binding, even one caused by a misconfigured device, makes communication drop out.

In OT networks this matters a great deal, because many industrial protocols have no authentication or encryption of their own. Whoever controls the ARP cache controls the conversation.

🔧 How does Dynamic ARP Inspection work?

You enable DAI per VLAN. Each switch port is then trusted or untrusted; by default every port is untrusted. The switch intercepts ARP packets arriving on untrusted ports and has its CPU check them:

1. Look up the binding - the switch looks up the sender’s IP address in the DHCP Snooping table (IP, MAC, VLAN and port).
2. Compare - if the IP and MAC combination matches, the packet is forwarded.
3. Drop and log - if it does not match, the switch discards the packet and writes a log entry.

Trusted ports, such as uplinks to another switch that already runs DAI, are not inspected. DAI only checks ingress traffic, so it only protects devices on switches where the feature is active.

Optional additional checks are also available:

🏭 How do you roll out DAI in an OT network with static IP addresses?

The biggest practical problem in OT is that PLCs, remote I/O and industrial switches almost always have a static IP address. Those devices never request an address via DHCP and are therefore missing from the DHCP Snooping table. If you switch DAI on without preparation, the switch blocks their ARP traffic and process communication stops.

A workable approach:

1. Inventory all IP-MAC bindings per VLAN, for example from your asset inventory or from a passive capture with Wireshark.
2. Record static bindings in an ARP access list (on Cisco switches arp access-list with permit ip host … mac host …) or as static bindings. With the static keyword only the ACL entries apply and there is no fallback to DHCP bindings.
3. Mark uplinks and trunks as trusted, or give them a generous limit; a trunk aggregates the ARP traffic of several VLANs.
4. Start in a test environment or maintenance window and review the logging before converting a production cell.
5. Persist the DHCP Snooping database (for example to flash memory), otherwise dynamic bindings are lost when the switch restarts.
6. Forward log entries via Syslog to your SIEM or network monitoring, so dropped packets get noticed.

After that, every addressing change, such as a replaced PLC with a new MAC address, requires an update to the ACL. Include DAI in your change management process for that reason.

📊 What default values and pitfalls does DAI have?

The values below are the defaults on Cisco Catalyst switches; other vendors use similar but not identical figures.

The rate limit exists to protect the switch CPU, because all ARP checks happen there. For an OT cell, however, a port in err-disable is just as disruptive as an attack: the connected PLC stays unreachable until someone intervenes. So measure the normal ARP volume first and set the limit accordingly.

Other limitations to keep in mind:

• IPv4 only - IPv6 uses Neighbor Discovery instead of ARP; it needs separate features.
• Not between devices on an unmanaged switch - two devices behind an unmanaged switch see each other’s ARP traffic without DAI ever seeing it.
• Support varies - many managed switches for IT and OT offer DAI, but not every industrial model or firmware version does; check this per type.

🔄 How does DAI relate to other Layer 2 controls?

DAI is one building block in a layered defence at Layer 2 of the OSI model. The features complement each other:

Anomaly detection often only sees an ARP attack through its consequences; DAI prevents it at the port. In IEC 62443 terms, DAI helps protect the integrity of communication within a zone, while network segmentation and firewalls govern the traffic between zones.

❓ Frequently asked questions

Does Dynamic ARP Inspection work without DHCP?

Yes, Dynamic ARP Inspection also works without DHCP, but you then have to record every IP-MAC binding yourself in ARP access lists or static bindings. In OT networks with static addresses this is the usual situation. Without those lists, DAI blocks the ARP traffic of statically addressed devices.

What is the difference between DAI and IP Source Guard?

Dynamic ARP Inspection only checks ARP messages, whereas IP Source Guard checks the source IP address of ordinary IP packets. Both features use the same DHCP Snooping binding table. Together they prevent both ARP poisoning and IP spoofing from a switch port.

Can DAI make a PLC unreachable?

Yes, a misconfigured Dynamic ARP Inspection setup can make a PLC unreachable. This happens when the PLC is missing from the bindings or ARP ACL, or when an ARP burst pushes the port over the rate limit and into err-disable. Test DAI first and tune the limits to measured traffic.

Does DAI need to be enabled on every switch port?

Dynamic ARP Inspection is enabled per VLAN and then checks every untrusted port in that VLAN. Ports to end devices stay untrusted, while uplinks to other switches running DAI are usually trusted. That way each ARP packet is checked once, at the edge of the network.

Does DAI also protect against IPv6 attacks?

No, Dynamic ARP Inspection only protects IPv4, because IPv6 does not use ARP but Neighbor Discovery. IPv6 needs separate switch features, such as Neighbor Discovery inspection and protection against rogue router advertisements. Even if you do not use IPv6, most operating systems have it enabled by default, so check this explicitly.

Is DAI enough to stop man-in-the-middle attacks?

No, Dynamic ARP Inspection only stops ARP poisoning on switches where it is active. An attacker can still get between systems by other routes, for example through a compromised server or an unmanaged switch. Combine DAI with segmentation, access control and monitoring.

📌 In summary

Dynamic ARP Inspection lets a managed switch check every ARP message on an untrusted port against known IP-MAC bindings from DHCP Snooping or ARP access lists. In OT this needs extra preparation, because most devices have static addresses and an overly tight rate limit can shut ports down. Configured well, together with Port Security, IP Source Guard and segmentation, DAI closes one of the simplest attack paths in industrial networks.

Dynamic ARP Inspection stops ARP poisoning at the switch port, but in OT it only works safely with static bindings for statically addressed devices and well-tuned limits.