A host on a user VLAN sends gratuitous ARP replies that claim the default gateway's IP address with the host's own MAC address. DHCP snooping is already enabled on that VLAN. Which feature stops this attack, and how?
Select an answer to reveal the explanation.
Short Explanation
ARP is a town where anyone can claim to be the post office and everyone believes them. Dynamic ARP inspection checks each claim against your DHCP snooping records before letting it through. The trap is port security, which happily lets a known MAC lie about its IP.
Full Explanation
ARP poisoning works because hosts accept unsolicited ARP replies and update their caches, so an attacker can claim the gateway's IP address and receive traffic meant for it. Dynamic ARP inspection intercepts ARP requests and replies on untrusted ports and compares the sender's IP-to-MAC pairing with the DHCP snooping binding table or with static ARP ACLs. A packet whose pairing does not match a valid binding is dropped and logged, so the forged gateway claim never reaches other hosts. Trusted ports, such as uplinks, are not inspected. IP source guard filters IP traffic from a port to the addresses bound to it; it does not inspect ARP content, and the CAM table maps MACs to ports, not IPs to MACs. Port security limits which source MACs a port accepts, but the attacker uses their own legitimate, already learned MAC address, so the forged ARP passes. Storm control limits traffic rates; a handful of forged replies is far below any broadcast threshold and would not be stopped. Exam caveat: DAI depends on DHCP snooping data, so hosts with static addresses need ARP ACLs or they will be blocked; DAI also rate-limits ARP on untrusted ports by default. Operational check: confirm DAI is enabled on the VLAN, the uplink is trusted, and the DAI statistics show dropped packets for the attacker's port.