Configuring Security
Dynamic ARP Inspection
Cisco 500 Series Stackable Managed Switch Administration Guide
342
18
Dynamic ARP Inspection
ARP enables IP communication within a Layer 2 Broadcast domain by mapping IP
addresses to a MAC addresses.
A malicious user can attack hosts, switches, and routers connected to a Layer 2
network by poisoning the ARP caches of systems connected to the subnet and by
intercepting traffic intended for other hosts on the subnet. This can happen
because ARP allows a gratuitous reply from a host even if an ARP request was not
received. After the attack, all traffic from the device under attack flows through the
attacker's computer and then to the router, switch, or host.
Figure 10
shows an example of ARP cache poisoning.
Figure 10 ARP Cache Poisoning
Hosts A, B, and C are connected to the switch on interfaces A, B and C, all of which
are on the same subnet. Their IP, MAC addresses are shown in parentheses; for
example, Host A uses IP address IA and MAC address MA. When Host A needs to
communicate with Host B at the IP layer, it broadcasts an ARP request for the MAC
address associated with IP address IB. When the switch and Host B receive the
ARP request, they populate their ARP caches with an ARP binding for a host with
the IP address IA and a MAC address MA. When Host B responds, the switch and
Host A populate their ARP caches with a binding for a host with the IP address IB
and the MAC address MB.
