To protect a network from Layer 2 man-in-the-middle attacks, AOS-CX switches utilize two closely related security features: DHCP Snooping and Dynamic ARP Protection.

DHCP Snooping: This feature acts as a firewall between untrusted hosts and trusted DHCP servers. When enabled, the switch categorizes ports as either trusted (connected to a legitimate DHCP server or another switch) or untrusted (connected to end-user devices). If a " malicious " DHCP server on an untrusted port attempts to send a DHCP OFFER or ACK message, the switch drops the packet.

The Snooping Binding Table: As a byproduct of monitoring legitimate DHCP exchanges, the switch builds a DHCP Snooping Binding Table. This table is a " source of truth " that maps a client ' s MAC address to its assigned IP address and the specific physical port it is connected to.

Dynamic ARP Protection: ARP poisoning (or spoofing) occurs when an attacker sends fake ARP messages to link their MAC address with the IP address of a legitimate server or gateway. When ARP protection is enabled, the switch intercepts all ARP packets on untrusted ports and validates them against the DHCP Snooping Binding Table. If the MAC-to-IP mapping in the ARP packet does not match the entry in the table, the packet is discarded.

Integration: These two features must work together. Without the binding table created by DHCP Snooping, ARP Protection has no data to validate against. This combination ensures that only the device that legitimately received an IP via DHCP can claim that IP in ARP responses.