How Do DHCP Snooping and Dynamic ARP Inspection Protect Layer 2 Networks?

Introduction
Layer 2 networks rely on protocols such as DHCP and ARP to provide hosts with network configuration and to map IP addresses to MAC addresses. Although these protocols are essential, attackers can abuse them to redirect traffic, impersonate devices, or disrupt network communication.
Cisco switches provide security features such as DHCP Snooping and Dynamic ARP Inspection (DAI) to help protect Layer 2 networks. DHCP Snooping builds trusted DHCP information, while DAI uses that information to validate ARP traffic.
What Is DHCP Snooping?
DHCP Snooping is a Layer 2 security feature that monitors DHCP messages passing through a switch. It classifies switch ports as trusted or untrusted and helps prevent unauthorized DHCP servers from providing incorrect network configuration to clients.
A legitimate DHCP server is normally connected through a trusted port, while client-facing ports are generally configured as untrusted.
How DHCP Snooping Works
When DHCP Snooping is enabled, the switch examines DHCP messages and applies its trust policy.

1. A client sends a DHCP request through an untrusted switch port.
2. The request is forwarded toward the trusted DHCP server.
3. The legitimate DHCP server sends a DHCP response through the trusted path.
4. The switch validates the DHCP message according to its configuration.
5. The switch can record the client’s IP address, MAC address, VLAN, and associated interface in a DHCP Snooping binding database.
   The binding database becomes an important source of information for other security features, including Dynamic ARP Inspection.
   Trusted and Untrusted Ports
   DHCP Snooping uses port trust states to distinguish expected DHCP server traffic from client-originated traffic.
   • Trusted ports – Normally used toward legitimate DHCP servers or approved DHCP infrastructure.
   • Untrusted ports – Normally used for end hosts and access ports. Unauthorized DHCP server responses can be blocked.
   Correct trust configuration is important. A port should be trusted only when the network design requires it to carry legitimate DHCP server traffic.
   What Is Dynamic ARP Inspection?
   Dynamic ARP Inspection, commonly called DAI, is a Layer 2 security feature that validates ARP packets. It helps protect networks against ARP spoofing and ARP poisoning attacks.
   ARP normally allows a host to associate an IPv4 address with a MAC address. Without appropriate validation, an attacker could send forged ARP messages that cause other hosts to associate the attacker’s MAC address with another IP address.
   How Dynamic ARP Inspection Works
   DAI checks ARP messages received on untrusted interfaces and compares relevant information against trusted data, commonly the DHCP Snooping binding database.
6. A host sends an ARP message.
7. The switch receives the ARP packet on an interface configured for DAI validation.
8. The switch checks the ARP information against its available validation data and configured policies.
9. If the packet is valid, it can be forwarded.
10. If the packet fails validation, the switch can drop it.
    How DHCP Snooping and DAI Work Together
    DHCP Snooping and DAI are especially useful when deployed together. DHCP Snooping creates a trusted binding between a client’s IP address, MAC address, VLAN, and switch interface. DAI can then use this information to validate ARP packets.
    A simplified relationship is:
    DHCP Server
    ↓
    DHCP Snooping
    ↓
    Binding Database
    ↓
    Dynamic ARP Inspection
    ↓
    ARP Validation
    What Threats Do They Help Prevent?
    These features are designed to mitigate several common Layer 2 attack techniques and configuration problems.
    • Rogue DHCP server activity – An unauthorized DHCP server may attempt to provide clients with incorrect gateway, DNS, or IP configuration.
    • DHCP-based address abuse – DHCP Snooping can help enforce expected DHCP behavior on untrusted interfaces.
    • ARP spoofing – An attacker may attempt to associate a false MAC address with another host’s IP address.
    • ARP poisoning – Forged ARP information can be used to redirect traffic through an attacker’s device.
    • Man-in-the-middle conditions – Successful ARP spoofing can enable traffic interception; DAI helps validate ARP information before forwarding it.
    DHCP Snooping Binding Database
    The DHCP Snooping binding database is one of the most important components of this security design. A typical entry can associate:
    • IP address
    • MAC address
    • VLAN
    • Switch interface
    • Lease-related information
    DAI can use these bindings to determine whether an ARP packet matches the expected IP-to-MAC relationship.
    Example of an ARP Spoofing Scenario
    Consider a Layer 2 network containing a legitimate client and an attacker. The attacker sends forged ARP messages claiming to own the IP address of another device, such as the default gateway.
    If those forged messages are accepted, hosts may update their ARP caches with incorrect information. Traffic intended for the gateway could then be redirected toward the attacker’s device.
    With DAI enabled and correctly configured, the switch can validate ARP information and drop packets that do not match the expected bindings or configured validation rules.
    Additional DHCP Snooping Security Controls
    DHCP Snooping can provide additional protections depending on the switch platform and configuration. These can include controls related to DHCP message rates and handling of DHCP messages on untrusted ports.
    Rate limiting can help reduce the impact of excessive DHCP traffic, while trust boundaries help prevent unauthorized DHCP server responses.
    Important Configuration Considerations
    DHCP Snooping and DAI must be deployed carefully because incorrect configuration can block legitimate traffic.
    • Identify legitimate DHCP server paths before configuring trusted interfaces.
    • Enable DHCP Snooping on the appropriate VLANs.
    • Verify that the DHCP Snooping binding table is being populated correctly.
    • Enable DAI on the appropriate VLANs and interfaces.
    • Configure trusted interfaces appropriately for network infrastructure.
    • Consider static bindings for devices that use fixed addressing and are not learned through DHCP, where supported and required.
    • Monitor switch logs and counters for dropped or invalid traffic.
    Benefits of DHCP Snooping and DAI
    • Blocks unauthorized DHCP server responses on untrusted ports.
    • Creates trusted IP-to-MAC binding information.
    • Helps detect and prevent invalid ARP traffic.
    • Reduces the risk of ARP spoofing and poisoning.
    • Protects Layer 2 network communication.
    • Provides an additional security layer at the access switch.
    Limitations
    These technologies are not a complete network-security solution. Their effectiveness depends on correct deployment, accurate trust boundaries, and the capabilities of the switch platform.
    Organizations should combine Layer 2 protections with other controls such as access control, endpoint security, network segmentation, monitoring, authentication, and secure management practices.
    

Conclusion
DHCP Snooping and Dynamic ARP Inspection provide important protections for Layer 2 networks. DHCP Snooping helps prevent unauthorized DHCP activity and builds trusted bindings between IP addresses, MAC addresses, VLANs, and interfaces. DAI uses this information and other configured validation mechanisms to inspect ARP traffic and block invalid mappings.
When properly configured together, these features can reduce the risk of rogue DHCP servers, ARP spoofing, ARP poisoning, and related Layer 2 attacks. They form an important part of a broader network-security strategy for enterprise switching environments.