# DAI (Dynamic ARP Inspection)

**URL:** https://forum.networklessons.com/t/dai-dynamic-arp-inspection/1296
**Category:** Lessons Discussion
**Created:** [December 29, 2016, 8:17pm UTC](https://forum.networklessons.com/t/dai-dynamic-arp-inspection/1296 "2016-12-29T20:17:00Z")
**Posts on this page:** 1
**Showing post:** 19

<div class="post-metadata">

### Author: ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [February 28, 2018, 3:41pm UTC](https://forum.networklessons.com/t/dai-dynamic-arp-inspection/1296/19 "2018-02-28T15:41:21Z")

</div>

Hello florian

My apologies for not responding sooner!

Keep in mind that the Sender hardware address and the target hardware addresses found within the ARP packet are not the source and destination MAC addresses found in the Ethernet header. Now you are correct when you say that:

> [@florianl](#):
>
> the frame would be switched to the host with the respective MAC from the Ethernet header but then the host would check the MAC in the ARP body and realize its not his and drop the frame,

DAI will cause such frames to drop so that they don’t actually reach the host. These are illegitimate packets and most likely come from a malicious source, so they should not be sent to the host. The host will not have to waste time and resources processing them.

> [@florianl](#):
>
> Also, how is it possible to deny Gratuitous ARP´s, as i thought those are a vital part of every interface for example!?

As for this question, my apologies. I had the `no ip gratuitous-arp` command in mind but this just disables the sending of gratuitous ARP packets by the device itself and not the blocking of such packets from hosts.

I hope this has been helpful!

Laz

---

_[View the full topic](https://forum.networklessons.com/t/dai-dynamic-arp-inspection/1296)._