ARP has no authentication. Every device on your LAN trusts every ARP reply
Attackers built entire toolkits around this single design flaw.
Dynamic ARP Inspection (DAI) and IP Source Guard close the gap. Together with DHCP Snooping, they complete the Layer 2 security triad every Cisco switch needs.
Why ARP fails: Address Resolution Protocol maps IP addresses to MAC addresses. When a device needs to reach its gateway, it broadcasts: "Who has 192.168.1.1?" — anyone can answer. No validation. No signature. No challenge. The last reply wins. An attacker sends one unsolicited ARP reply claiming to be the default gateway. Every device on the VLAN updates its cache. All traffic is silently redirected.
Dynamic ARP Inspection — stops ARP spoofing
Switch(config)# ip arp inspection vlan 10,20,30
Switch(config)# interface GigabitEthernet0/1 Switch(config-if)# ip arp inspection trust
Switch(config)# interface range FastEthernet0/1 - 24 Switch(config-if-range)# ip arp inspection limit rate 100
DAI validates every ARP packet against the DHCP Snooping binding table. If the IP-to-MAC mapping does not match a known legitimate lease, the packet is dropped. Uplink ports toward your distribution layer are marked trusted. All access ports remain untrusted by default.
IP Source Guard — stops IP spoofing
Switch(config)# interface range FastEthernet0/1 - 24 Switch(config-if-range)# ip verify source
IP Source Guard filters traffic at the port level. Any packet sourced from an IP not matching the binding table entry for that port is dropped in hardware before entering the network. A compromised device cannot impersonate another host's IP address.
Verify both controls
Switch# show ip arp inspection vlan 10 Switch# show ip arp inspection statistics Switch# show ip verify source
The complete Layer 2 security stack: Port Security — blocks rogue devices and MAC flooding. DHCP Snooping — blocks rogue DHCP servers, builds the binding table. Dynamic ARP Inspection — blocks ARP spoofing and cache poisoning. IP Source Guard — blocks IP address impersonation.
Remove one control and the chain breaks.
Real consequence: Without DAI, one gratuitous ARP redirects every outbound session through an attacker's machine. Credentials, session tokens, and internal communications are captured without a single alert. The firewall sees nothing. Interception continues until a manual audit reveals a poisoned ARP cache — often weeks after the initial compromise.
All four features are native to every Cisco Catalyst switch. No additional license. No additional hardware. Under thirty minutes to deploy across a full access layer.
The only reason not to have them is not knowing they exist.
Is your Layer 2 stack complete — or is your network one ARP reply away from a full interception?