User Manual

Table Of Contents
NETGEAR M4500 Series Switches CLI Command Reference Manual 504
5.19. Dynamic ARP Instpection (DAI) Command
Dynamic ARP Inspection (DAI) is a security feature that rejects invalid and malicious ARP packets. DAI prevents a
class of man-in-the-middle attacks, where an unfriendly station intercepts traffic for other stations by poisoning
the ARP caches of its unsuspecting neighbors. The miscreant sends ARP requests or responses mapping another
station's IP address to its own MAC address.
To prevent ARP poisoning attacks, a switch must ensure that only valid ARP requests and responses are relayed.
DAI prevents these attacks by intercepting all ARP requests and responses. Each of these intercepted packets is
verified for valid MAC address to IP address bindings before the local ARP cache is updated or the packet is
forwarded to the appropriate destination. Invalid ARP packets are dropped.
DAI determines the validity of an ARP packet based on valid MAC address to IP address bindings stored in a
trusted database. This database is built at runtime by DHCP snooping, provided this feature is enabled on VLANs
and on the switch. DAI relies on DHCP snooping. DHCP snooping listens to DHCP message exchanges and builds a
binding database of valid {MAC address, IP address, VLAN, and interface} tuples. In addition, in order to handle
hosts that use statically configured IP addresses, DAI can also validate ARP packets against user-configured ARP
ACLs.
When DAI is enabled, the switch drops ARP packets whose sender MAC address and sender IP address do not
match an entry in the DHCP snooping bindings database. You can optionally configure additional ARP packet
validation.
5.19.1. Show commands
5.19.1.1. show ip arp instpection statistics
This command displays the statistics of the ARP packets processed by Dynamic ARP Inspection. Give the vlan-list
argument and the command displays the statistics on all DAI-enabled VLANs in that list. Give the single vlan
argument and the command displays the statistics on that VLAN. If no argument is included, the command lists a
summary of the forwarded and dropped ARP packets.
Format show ip arp inspection statistics [vlan <vlan-list>]
Default None
Mode Privileged Exec
Display Message
Term
Definition
<vlan-list>
Specifies VLAN ID in a list. The range of VLAN ID is 1 to 4093.
Term
Definition
VLAN
The VLAN ID for each displayed row.
DHCP Drops
The number of packets dropped due to DHCP snooping binding database match
failure.
ACL Drops
The number of packets dropped due to ARP ACL rule match failure.
DHCP Permits
The number of packets permitted due to DHCP snooping binding database match.
ACL Permits
The number of packets permitted due to ARP ACL rule match.
Bad Src MAC
The number of packets dropped due to Source MAC validation failure.