Dell PowerConnect J-EX8208, Software Manual

Page: 2628 / 3660

Address Resolution Protocol
Sending IP packets on a multiaccess network requires mapping an IP address to an
Ethernet media access control (MAC) address.
Ethernet LANs use Address Resolution Protocol (ARP) to map MAC addresses to IP
addresses.
The switch maintains this mapping in a cache that it consults when forwarding packets
to network devices. If the ARP cache does not contain an entry for the destination device,
the host (the DHCP client) broadcasts an ARP request for that device's address and
stores the response in the cache.
ARP Spoofing
ARP spoofing (also known as ARP poisoning or ARP cache poisoning) is one way to
initiate man-in-the-middle attacks. The attacker sends an ARP packet that spoofs the
MAC address of another device on the LAN. Instead of the switch sending traffic to the
proper network device, it sends it to the device with the spoofed address that is
impersonating the proper device. If the impersonating device is the attacker's machine,
the attacker receives all the traffic from the switch that should have gone to another
device. The result is that traffic from the switch is misdirected and cannot reach its proper
destination.
One type of ARP spoofing is gratuitous ARP, which is when a network device sends an
ARP request to resolve its own IP address. In normal LAN operation, gratuitous ARP
messages indicate that two devices have the same MAC address. They are also broadcast
when a network interface card (NIC) in a device is changed and the device is rebooted,
so that other devices on the LAN update their ARP caches. In malicious situations, an
attacker can poison the ARP cache of a network device by sending an ARP response to
the device that directs all packets destined for a certain IP address to go to a different
MAC address instead.
To prevent MAC spoofing through gratuitous ARP and through other types of spoofing,
J-EX Series switches examine ARP responses through DAI.
DAI on J-EX Series Switches
DAI examines ARP requests and responses on the LAN and validates ARP packets. The
switch intercepts ARP packets from an access port and validates them against the DHCP
snooping database. If no IP-MAC entry in the database corresponds to the information
in the ARP packet, DAI drops the ARP packet and the local ARP cache is not updated
with the information in that packet. DAI also drops ARP packets when the IP address in
the packet is invalid.
The Junos OS for J-EX switches uses DAI for ARP packets received on access ports
because these ports are untrusted by default. Trunk ports are trusted by default, so ARP
packets bypass DAI on them.
You configure DAI for each VLAN, not for each interface (port). By default, DAI is disabled
for all VLANs. You can set an interface to be trusted for ARP packets by setting
dhcp-trusted
on that port.
2556
Dell PowerConnect J-Series Ethernet Switch Complete Software Guide for Junos OS