How does DAI validate ARP packets?

How does DAI validate ARP packets?

• A. It compares ARP requests and replies against entries in the DHCP snooping database.
• B. It uses ARP nonce values
• C. It requires ARP authentication
• D. It uses DNS queries

Answer: (A)

Dynamic ARP Inspection validates ARP packets by cross-checking them against the DHCP snooping binding table. When an ARP packet arrives on an untrusted port, DAI compares the sender IP and MAC in the ARP packet to the IP-to-MAC binding learned from DHCP snooping. If the mapping exists and matches, the ARP packet is allowed; if not, it is dropped. This prevents ARP spoofing and MITM attacks by ensuring ARP communications reflect legitimate, DHCP-assigned bindings. The DHCP snooping database is built from DHCP messages (and can be augmented with static bindings if DHCP isn’t used). Other ideas like ARP nonce values, ARP authentication, or DNS queries are not how DAI performs this validation.

Dynamic ARP Inspection validates ARP packets by cross-checking them against the DHCP snooping binding table. When an ARP packet arrives on an untrusted port, DAI compares the sender IP and MAC in the ARP packet to the IP-to-MAC binding learned from DHCP snooping. If the mapping exists and matches, the ARP packet is allowed; if not, it is dropped. This prevents ARP spoofing and MITM attacks by ensuring ARP communications reflect legitimate, DHCP-assigned bindings. The DHCP snooping database is built from DHCP messages (and can be augmented with static bindings if DHCP isn’t used). Other ideas like ARP nonce values, ARP authentication, or DNS queries are not how DAI performs this validation.