9.5 Dynamic ARP Inspection (DAI) Explained
Key Concepts of Dynamic ARP Inspection (DAI)
Dynamic ARP Inspection (DAI) is a security feature that protects against ARP spoofing attacks by validating ARP packets in a network. Key concepts include:
- ARP Spoofing: An attack where an attacker sends falsified ARP messages to associate their MAC address with the IP address of another device.
- DAI Mechanism: The process of intercepting, logging, and discarding invalid ARP packets.
- Trusted and Untrusted Ports: Ports designated as trusted or untrusted based on their security level.
- DHCP Snooping: A feature that builds a trusted IP-to-MAC address mapping table, which is used by DAI to validate ARP packets.
ARP Spoofing
ARP Spoofing is a type of attack where an attacker sends falsified ARP messages over a local network. This results in the linking of the attacker's MAC address with the IP address of a legitimate computer or server on the network. As a result, all traffic meant for that IP address is sent to the attacker instead.
Example: In a corporate network, an attacker could send ARP messages to associate their MAC address with the IP address of the default gateway. This would redirect all traffic intended for the gateway to the attacker's device, allowing them to intercept and potentially alter the traffic.
DAI Mechanism
The DAI mechanism involves intercepting ARP packets on untrusted ports, logging the packets, and discarding any invalid ARP packets. This helps in preventing ARP spoofing attacks by ensuring that only valid ARP packets are allowed to pass through the network.
Example: When a MikroTik switch receives an ARP packet on an untrusted port, it checks the packet against the trusted IP-to-MAC address mapping table. If the packet is invalid (e.g., the MAC address does not match the expected address for the IP), the switch discards the packet and logs the event.
Trusted and Untrusted Ports
Ports on a switch can be designated as trusted or untrusted based on their security level. Trusted ports are typically those connected to devices that are known to be secure, such as servers or network infrastructure devices. Untrusted ports are those connected to end-user devices that may be more susceptible to attacks.
Example: In a MikroTik switch, you can configure the port connected to the corporate server as a trusted port and all other ports connected to employee workstations as untrusted ports. This ensures that ARP packets from the server are always trusted, while packets from workstations are validated.
DHCP Snooping
DHCP Snooping is a feature that builds a trusted IP-to-MAC address mapping table by monitoring DHCP traffic. This table is used by DAI to validate ARP packets, ensuring that only legitimate IP-to-MAC address bindings are allowed in the network.
Example: When a MikroTik switch receives a DHCP request from a device, it logs the IP address and MAC address in the DHCP Snooping binding table. This table is then used by DAI to validate ARP packets, ensuring that only devices with valid IP-to-MAC bindings can communicate on the network.