DAI Commands

Command	Purpose
Ip arp inspection vlan vlan-range	Global command to enable DAI on this switch for the specified VLANs
[no] ip arp inspection trust	Interface subcommand that enable or disable DAI on the interface.
Ip arp inspection filter arp-acl-name vlan vlan-range [static]	Global command to refer to an ARP ACL that defines static IP/MAC address to be checked by DAI for that VLAN (step-2)
Ip arp inspection validate {[src-mac] [dst-mac] [ip]}	Enables additional optional checking of ARP messages (per step 3-5) in the preceding list)
Ip arp inspection limit {rate pps [burst interval seconds] | none }	Limits the ARP message rate to prevent DoS attacks carried out by sending a large number or ARPs.

• DAI automatically sets a limit of 15 ARP messages per port per second to mitigate that risk
• ip arp inspection limit  uses to change these default value
  

DAI logical Steps in finding inappropriate messages

• If an ARP reply lists a source ip address that was not DHCP assigned to a device off that port, DAI filters the ARP reply.
• DAI also uses a list of statically defined IP/MAC address combinations for comparision.
• For a recievied ARP reply, 
• DAI compares the source MAC address in the ethernet header to the source MAC address in ARP message.
• These MACs should be equal in normal ARP replies.
• If they are not, DAI filters the ARP message.
• Like in above step DAI compares the destination Ethernet MAC and the target MAC listed in the ARP body.
• DAI checks for unexpected IP addresses listed in the ARP message, such as 0.0.0.0, 255.255.255.25, multicasts, & so on.

Dynamic ARP Inspection (DAI)

• Switch uses DAI to prevent certain types of attacks.
• To do this switch, can effectively uses the IP ARP messages.
• ARP message includes 4 important addressing fields:
• Source MAC & IP address of the sender of the message
• Target MAC & IP address
• Gratuitous ARPs:
• Gratuitous ARP occurs when a host sends an ARP reply, without even seeing an ARP request, & with a broadcast destination Ethernet address.
• DAI defeat ARP attack by examining the ARP messages & then filter out the inappropriate messages.
• DAI considers each switch port to be either untrusted (the default) or trusted.
• DAI perform messages on untrusted ports only.

Port Security Config Commands

Command	Purpose
Switchport mode { access | trunk}	Port security requires that the port be statically set as either access or trunking
Switchport port-security [maximum value}	Enables port security on an interface & optionally defines the number of allowed MAC addresses on the port (default 1)
Switchport port-security mac-address mac-addres [vlan {vlan-id| {access | voice}}	Statically defines an allowed MAC address, for a particular VLAN (if trunking), & for either the access or voice VLAN
Switchport port-security mac-address sticky	Tells the switch to remember the dynamically learned MAC address
Switchport port-security [aging] [violation {protect | restrict | shutdown}]	Define the aging timer & actions taken when a violation occurs.

Port Security

• Switch port security monitors a port to restrict the number of MAC addresses associated with that port in the layer 2 switching table.
• Also possible to make only certain mac addresses only reach the Port.
• Key features of Port Security:
• Limiting the number of MACs  that can be associated with the port.
• This limiting of MACs will be done based on following 3 methodes:
• Static configuration of the allowed MAC addresses.
• Dynamic learning of MAC addresses, up to the defined maximum, where dynamic entries are lost upon reload
• Dynamically learning but with the switch saving those entries in the configuration (called sticky learning)
•