DHCP snooping is a great solution to prevent rogue DHCP servers on your network. Which security feature on switchers leverages the DHCP snooping…

Dynamic ARP Inspection (DAI) is a security feature that validates Address Resolution Protocol (ARP) packets on a network. It intercepts, logs, and discards ARP packets with invalid IP-to-MAC address bindings. To determine the validity of these bindings, DAI relies directly on the trusted database built and maintained by DHCP snooping. By ensuring that only legitimate ARP packets are forwarded, DAI effectively mitigates ARP spoofing, which is a primary technique used to launch man-in-the-middle (MITM) attacks at Layer 2.

A. Spanning tree: This protocol's purpose is to prevent Layer 2 switching loops in networks with redundant paths; it does not use the DHCP snooping database.

C. Port security: This feature restricts port access based on MAC addresses to prevent unauthorized device connections, but it does not inspect ARP packets or use the DHCP snooping database.

D. Layer 2 Attack Prevention Protocol (LAPP): This is not a standardized or commonly recognized industry protocol for this purpose; it is likely a distractor.

1. Cisco Systems Official Documentation: In the IP Addressing: DHCP Configuration Guide

Cisco IOS XE Gibraltar 16.12.x

the section on "Dynamic ARP Inspection" explicitly states: "DAI determines the validity of an ARP packet based on the valid IP-to-MAC address bindings stored in a DHCP snooping database." (Cisco Systems

"Configuring Dynamic ARP Inspection

" Section: How to Configure Dynamic ARP Inspection).

2. University Courseware: In course materials for "NSSA-413 Network Security and Forensics

" Rochester Institute of Technology (RIT) explains the relationship: "Dynamic ARP Inspection (DAI) [...] uses the DHCP snooping database to validate ARP packets. This prevents ARP poisoning/spoofing." (Rochester Institute of Technology

Department of Computing Security

NSSA-413 Lecture Notes on Layer 2 Security

Slide 19).

3. Peer-Reviewed Publication: A paper on network security mechanisms describes the synergy: "To prevent ARP spoofing attacks

Dynamic ARP Inspection (DAI) is used. DAI works with DHCP snooping feature. DHCP snooping builds and maintains a binding table... DAI uses this table to validate ARP packets." (Al-Taei

A.

& Al-Raweshidy

H. S. (2017). A survey of layer 2 security attacks and their mitigation schemes. 2017 10th International Conference on Developments in eSystems Engineering (DeSE)

pp. 13-18. DOI: https://doi.org/10.1109/DeSE.2017.15

Section III-B).