70 ◾ Network Attacks and Defenses: A Hands-on Approach
protect the above hosts from an ARP cache poisoning attack,
the following ARP ACL is created:
Permit ip host Sender-IP-A mac host Sender-MAC-A
Permit ip host Sender-IP-B mac host Sender-MAC-B
Permit ip host Sender-IP-C mac host Sender-MAC-C
Permit ip host Sender-IP-D mac host Sender-MAC-D
Deny ip any mac any log
Dynamic ARP Inspection can be also configured to drop
ARP packets when the IP addresses are invalid or when the
MAC addresses in the ARP header do not match the addresses
specified in the Ethernet header.
It is important to mention that most switches use ARP ACLs
to test only the validity of the source IP and MAC pair in the
ARP header. They are not used to test the validity of the de ...