How Dai Works - Dell PowerConnect B-RX Configuration Manual

35
Dynamic ARP inspection
gratuitous replies without having received any ARP requests. A malicious host can also send out
ARP packets claiming to have an IP address that actually belongs to another host (e.g. the default
router). After the attack, all traffic from the device under attack flows through the attacker's
computer and then to the router, switch, or host.

How DAI works

DAI allows only valid ARP requests and responses to be forwarded.
A Brocade device on which DAI is configured does the following:
•
•
•
•
When you enable DAI on a VLAN, by default, all member ports are untrusted. You must manually
configure trusted ports. In a typical network configuration, ports connected to host ports are
untrusted. You configure ports connected to other switches or routers as trusted.
DAI inspects ARP packets received on untrusted ports, as shown in
inspection based on IP-to-MAC address bindings stored in a trusted binding database. For the
BigIron RX, the binding database is the ARP table, which supports DAI, DHCP snooping, and IP
Source Guard. To inspect an ARP request packet, DAI checks the source IP and source MAC
address against the ARP table. For an ARP reply packet, DAI checks the source IP, source MAC,
destination IP, and destination MAC addresses. DAI forwards the valid packets and discards those
with invalid IP-to-MAC address bindings.
When ARP packets reach a trusted port, DAI lets them through, as shown in
FIGURE 128
ARP entries
DAI uses the IP/MAC mappings in the ARP table to validate ARP packets received on untrusted
ports.
984
Intercepts ARP packets received by the system CPU.
Inspects all ARP requests and responses received on untrusted ports.
Verifies that each of the intercepted packets has a valid IP-to-MAC address binding before
updating the local ARP table, or before forwarding the packet to the appropriate destination.
Drops invalid ARP packets
Dynamic ARP Inspection at work
ARP
packet DAI
Foundry Device
Figure 128. DAI carries out the
Figure 128.
ARP
packet
BigIron RX Series Configuration Guide
53-1001986-01