CISCO-DYNAMIC-ARP-INSPECTION-MIB

All MIBs › CISCO-DYNAMIC-ARP-INSPECTION-MIB

Organization: Cisco Systems, Inc.

Last Updated: 2011-03-21

Category: Cisco Devices, VPN and Security

Description: Manages Dynamic ARP Inspection (DAI) on Cisco switches, monitoring ARP packet validation, binding table entries, and violation counts.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCO-DYNAMIC-ARP-INSPECTION-MIB?

CISCO-DYNAMIC-ARP-INSPECTION-MIB manages Dynamic ARP Inspection (DAI), a Cisco switch security feature that validates ARP packets on access ports against a trusted binding table to prevent ARP spoofing and poisoning attacks. It exposes global configuration objects (logging enable, address validation mode, log buffer size/rate/interval) as well as a log buffer table recording individual violation entries with interface, VLAN, and sender MAC address. Its monitoring value is software-level security-state visibility: the volume and detail of logged ARP violations reveal active spoofing attempts or misconfigured hosts, and the log buffer table lets an admin pinpoint exactly which port and VLAN generated a suspicious ARP packet. It is a Cisco security feature MIB that depends on the switch's VLAN and interface infrastructure, referencing IF-MIB-style interface bindings, and often works alongside DHCP snooping MIBs since DAI's trust database is typically built from DHCP snooping bindings. It is deployed on Cisco Catalyst switches in enterprise networks enforcing Layer 2 security against ARP spoofing, and administrators can download the CISCO-DYNAMIC-ARP-INSPECTION-MIB file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCO-DYNAMIC-ARP-INSPECTION-MIB. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco Catalyst switches

Monitoring Examples

An admin can check cdaiLoggingEnable and cdaiAddressValidate to confirm DAI logging and validation modes are active, then poll cdaiLogBufferTable/cdaiLogBufferEntry for cdaiLogBufferInterface, cdaiLogBufferVlan, and cdaiLogBufferSenderMacAddress to see recent violations. A burst of new entries all citing the same cdaiLogBufferSenderMacAddress on one port would reveal a host actively sending forged ARP packets, i.e. an ARP spoofing attempt.

What Can Be Monitored

DAI logging status
ARP validation mode
ARP violation log entries
violating interface/VLAN
sender MAC address of violations

Imported Objects

From CISCO-PRIVATE-VLAN-MIB

VlanIndexOrZero

From CISCO-SMI

ciscoMgmt

OBJECT-IDENTITY

From IF-MIB

InterfaceIndexOrZero
ifIndex	OBJECT-TYPE

From INET-ADDRESS-MIB

InetAddress
InetAddressType

From Q-BRIDGE-MIB

VlanIndex

From SNMP-FRAMEWORK-MIB

SnmpAdminString

From SNMPv2-CONF

MODULE-COMPLIANCE
OBJECT-GROUP

From SNMPv2-SMI

Counter32
Gauge32
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DateAndTime
MacAddress
RowStatus
StorageType
TruthValue

How to Use in IPNetwork Monitor

Example using cdaiVlanForwarded OID:

Select a Cisco Catalyst switch as the target host to create a monitor — the SNMP service should be up and running on it. Click New Monitor, then check SNMP Custom on the Favorites tab, click Next, and confirm the host. On the next page, click Select... to open the built-in SNMP MIB Browser and type cdaiVlanForwarded into the Find box to locate it in the OID tree, selecting the specific row/instance you want to monitor since this is a table column, then select it and click OK. This object indicates the number of ARP packets forwarded by Dynamic Arp Inspection feature. On the monitor's Main parameters page you can set the target's SNMP port (default 161), credentials, polling interval, and other settings — see the SNMP Monitor help for details. On the State conditions and Alerting tabs, configure when the monitor should change state and trigger an alert; since this is a Counter32-type OID, Value bounds is the most useful condition here — trigger an alert if the counter increases sharply between polls relative to its normal baseline (in packets), since an unexpected spike often reflects a real change in traffic or activity. Click Finish to create the monitor; you can adjust any parameter later.

OIDs

OID symbolic	OID numeric	Type	Access	Description
ciscoDynamicArpInspectionMIB	1.3.6.1.4.1.9.9.374			The MIB module is for configuration of Dynamic ARP Inspection feature. Dynamic ARP Inspection is a security mechanism which validate ARP packets seen on access ports.
cdaiMIBNotifs	1.3.6.1.4.1.9.9.374.0
cdaiMIBObjects	1.3.6.1.4.1.9.9.374.1
cdaiGlobal	1.3.6.1.4.1.9.9.374.1.1
T/F cdaiLoggingEnable	1.3.6.1.4.1.9.9.374.1.1.1	TruthValue	read-write	This object indicates whether the Dynamic ARP Inspection logging is enabled on the device. If this object is set to 'true', Dynamic ARP Inspection logging is enabled. If this object is set to 'false', Dynamic ARP Inspection logging is disabled.
BIT cdaiAddressValidate	1.3.6.1.4.1.9.9.374.1.1.2	Bits	read-write	This object specifies address validation criteria used by Dynamic ARP Inspection feature. 'srcMacAddress' indicates that source MAC address in ethernet header is checked against the sender MAC address in ARP packet. When this bit is on, packets with different MAC addresses are classified as invalid packets and are dropped. This checking is done for both ARP request and ARP response packet. 'dstMacAddress' indicates that the destination MAC address in ethernet header is checked against the target MAC address in ARP packet. When this bit is on, packets with different addresses are classified as invalid packets and are dropped. This checking is done for ARP response packet only. 'ip' indicates that the IP addresses in ARP packet are checked for invalid or unexpected IP addresses. Addresses such as 0.0.0.0, 255.255.255.255 and all IP multicast addresses are considered invalid. When this bit is on, both the sender and target IP addresses in the ARP packet are checked. This checking is done for both ARP request and response packet. 'ipAllowZeros' works the same as 'ip' but address 0.0.0.0 is allowed. 'ip' and 'ipAllowZeros' are mutually exclusive.
U32 cdaiLogBufferSize	1.3.6.1.4.1.9.9.374.1.1.3	Unsigned32	read-write	This object specifies the size of the logging buffer.
U32 cdaiLoggingRate	1.3.6.1.4.1.9.9.374.1.1.4	Unsigned32	read-write	This object specifies the maximum number of logging entries will be logged during the time period denoted by cdaiLoggingInterval object for system message generation purpose. Zero value indicates that entry is placed in the log buffer, but a system message is not generated.
U32 cdaiLoggingInterval	1.3.6.1.4.1.9.9.374.1.1.5	Unsigned32	read-write	This object specifies the logging interval for system message generation purpose. Zero value indicates that system message is immediately generated (and the log buffer is always empty). Value of this object and value of cdaiLoggingRate object cannot be zero at the same time.
INT cdaiLogBufferAction	1.3.6.1.4.1.9.9.374.1.1.6	INTEGER	read-write	This objects specifies the action can be taken with respect to logging buffer. 'none' indicates that no operation is performed. This object always return value 'none' when read. 'clear' indicates that all entries in cdaiLoggingBufferTable will be cleared.
cdaiLogBufferTable	1.3.6.1.4.1.9.9.374.1.1.7		not-accessible	A table provides the information of logged ARP flows for system message generation.
cdaiLogBufferEntry	1.3.6.1.4.1.9.9.374.1.1.7.1		not-accessible	A row instance contains logged ARP flow data for system message generation. Entries in the log are cleared once system messages are generated on their behalf. A special entry will be populated for accounting drops of all flows that result in exceeding the number of entries of the log buffer. Special entry only contains packets counter and timestamps information. The rest of its fields are irrelevant.
U32 cdaiLogBufferIndex	1.3.6.1.4.1.9.9.374.1.1.7.1.1	Unsigned32	not-accessible	This object uniquely identifies a logged ARP flow in the buffer.
NUM cdaiLogBufferInterface	1.3.6.1.4.1.9.9.374.1.1.7.1.2	InterfaceIndexOrZero	read-only	This object indicates the interface which sent the logged ARP flow. Zero value indicates the special entry.
VLA cdaiLogBufferVlan	1.3.6.1.4.1.9.9.374.1.1.7.1.3	VlanIndexOrZero	read-only	This object indicates the VLAN number which the logged ARP flow belongs to. Zero value indicates the special entry.
MAC cdaiLogBufferSenderMacAddress	1.3.6.1.4.1.9.9.374.1.1.7.1.4	MacAddress	read-only	This object indicates the sender MAC address of the logged ARP flow. All zeros MAC address value indicates the special entry.
IPt cdaiLogBufferSenderAddressType	1.3.6.1.4.1.9.9.374.1.1.7.1.5	InetAddressType	read-only	This object indicates the sender Internet address type of the logged ARP flow.
IP cdaiLogBufferSenderIpAddress	1.3.6.1.4.1.9.9.374.1.1.7.1.6	InetAddress	read-only	This object indicates the sender Internet address of the logged ARP flow. The type of this address is determined by the value of cdaiLogBufferSenderAddressType object. All zeros IP address value indicates the special entry.
INT cdaiLogBufferReason	1.3.6.1.4.1.9.9.374.1.1.7.1.7	INTEGER	read-only	This object indicates the reason for logging this ARP flow. 'unknown' indicates unknown reason. 'deny' indicates that this ARP flow is logged because it is denied by Dynamic ARP Inspection feature. 'aclDeny' indicates that this ARP flow is logged because it is denied by a configured ARP ACL. 'aclPermit' indicates that this ARP flow is logged because it is permitted by a configured ARP ACL. 'dhcpDeny' indicates that this ARP flow is logged because it is denied when comparing with DHCP bindings information. 'dhcpPermit' indicates that this ARP flow is logged because it is permitted when comparing with DHCP binding information. 'probePermit' indicates that this ARP flow is logged because it is a permitted ARP-Probe flow.
DAT cdaiLogBufferLastUpdate	1.3.6.1.4.1.9.9.374.1.1.7.1.8	DateAndTime	read-only	This object indicates the timestamp when the last packet of this flow was accounted by the system.
G32 cdaiLogBufferPacketsCount	1.3.6.1.4.1.9.9.374.1.1.7.1.9	Gauge32	read-only	This object indicates the number of packets of this ARP flow was accounted by the system.
cdaiVlan	1.3.6.1.4.1.9.9.374.1.2
cdaiVlanConfigTable	1.3.6.1.4.1.9.9.374.1.2.1		not-accessible	A table provides the mechanism to control Dynamic ARP Inspection per VLAN. When a VLAN is created in a device supporting this table, a corresponding entry of this table will be added.
cdaiVlanConfigEntry	1.3.6.1.4.1.9.9.374.1.2.1.1		not-accessible	A row instance contains the configuration to enable or disable Dynamic ARP Inspection at each existing VLAN.
VLA cdaiVlanIndex	1.3.6.1.4.1.9.9.374.1.2.1.1.1	VlanIndex	not-accessible	This object indicates the VLAN number on which Dynamic ARP Inspection feature is configured.
T/F cdaiVlanDynArpInspEnable	1.3.6.1.4.1.9.9.374.1.2.1.1.2	TruthValue	read-write	This object indicates whether Dynamic ARP Inspection is enabled in this VLAN. If this object is set to 'true', Dynamic ARP Inspection is enabled. If this object is set to 'false', Dynamic ARP Inspection is disabled.
cdaiVlanCfgTable	1.3.6.1.4.1.9.9.374.1.2.2		not-accessible	A table provides the mechanism to control Dynamic ARP Inspection per VLAN. This table is populated for each existing VLAN in the device as well as non-existing VLANs which contains the Dynamic ARP Inspection configuration.
cdaiVlanCfgEntry	1.3.6.1.4.1.9.9.374.1.2.2.1		not-accessible	A row instance contains the Dynamic ARP inspection configuration for a specific VLAN in the device.
VLA cdaiVlanId	1.3.6.1.4.1.9.9.374.1.2.2.1.1	VlanIndex	not-accessible	This object indicates the VLAN number.
INT cdaiVlanDynArpInspAdmin	1.3.6.1.4.1.9.9.374.1.2.2.1.2	INTEGER	read-create	This object specifies the administrative status of Dynamic ARP Inspection feature in this VLAN. If this object value is 'enable', Dynamic ARP Inspection is enabled. If this object value is 'disable', Dynamic ARP Inspection is disabled.
INT cdaiVlanDynArpInspOper	1.3.6.1.4.1.9.9.374.1.2.2.1.3	INTEGER	read-only	This object indicates the operational status of Dynamic ARP Inspection feature in this VLAN. If this object is 'active', Dynamic ARP Inspection is operationally active. If this object is 'inactive', Dynamic ARP Inspection is operationally inactive.
STR cdaiVlanFilterArpAclName	1.3.6.1.4.1.9.9.374.1.2.2.1.4	SnmpAdminString	read-create	This object specifies an ARP ACL name that Dynamic ARP Inspection feature uses to check the validity of the bindings information in ARP body. An emptry string indicates that no such ARP ACL is configured for this purpose.
T/F cdaiVlanFilterArpAclStatic	1.3.6.1.4.1.9.9.374.1.2.2.1.5	TruthValue	read-create	This object specifies whether the ARP ACL denoted by cdaiVlanFilterArpAclName is statically applied by Dynamic ARP Inspection feature. This object does not take effect if value of cdaiVlanFilterArpAclName on the row is an empty string. 'true' indicates that ARP ACL is applied statically. The action (denied or permitted) results from applying the ARP ACL is final and ARP packet is not compared against DHCP bindings information. 'false' indicates ARP ACL is not applied statically. If ARP packet is not explicitly classified by ARP ACL, it will be compared against DHCP bindings information.
INT cdaiVlanAclLogging	1.3.6.1.4.1.9.9.374.1.2.2.1.6	INTEGER	read-create	This object specifies the logging configuration that Dynamic ARP Inspection feature applies to ARP packets when they are classified by the configured ACL. 'none' indicates that no logging is performed when packets are classified by the configured ACL. 'aclMatch' indicates that logging is performed when packets are classified by the configured ACL and the matched ACE specified a logging action. 'deny' indicates that logging is performed when packets is denied by the configured ACL.
INT cdaiVlanDhcpBindingLogging	1.3.6.1.4.1.9.9.374.1.2.2.1.7	INTEGER	read-create	This object specifies packet logging configuration performed by Dynamic ARP Inspection feature when ARP packets is compared against DHCP bindings information. 'none' indicates that no packet logging is performed. 'permit' indicates that packet logging is performed only for packets that are permitted as a result of comparing with DHCP bindings information. 'deny' indicates that packet logging is performed only for packets that are denied as a result of comparing with DHCP bindings information. 'all' indicates that packet logging is performed for all packets that are permitted or denied as a result of comparing with DHCP bindings information.
T/F cdaiVlanArpProbeLogging	1.3.6.1.4.1.9.9.374.1.2.2.1.8	TruthValue	read-create	The objects specifies if ARP-Probe packets will be logged by Dynamic ARP Inspection feature. 'true' indicates ARP-Probe packets will be logged. 'false' indicates ARP-Probe packets will not be logged.
STO cdaiVlanCfgStorageType	1.3.6.1.4.1.9.9.374.1.2.2.1.9	StorageType	read-create	The objects specifies the storage type for this conceptual row.
ROW cdaiVlanCfgRowStatus	1.3.6.1.4.1.9.9.374.1.2.2.1.10	RowStatus	read-create	The status of this conceptual row entry. This object is used to manage creation and deletion of rows in this table. Deletion of an entry in this table is only allowed if the VLAN indicated by its row index object does not exist in the device. Writable objects can be modified at any time even while the row is active.
cdaiInterface	1.3.6.1.4.1.9.9.374.1.3
cdaiIfConfigTable	1.3.6.1.4.1.9.9.374.1.3.1		not-accessible	A table provides the mechanism to configure the trust state for Dynamic ARP Inspection purpose at each physical interface capable of this feature. Some of the interfaces (but not limited to) for which this feature might be applicable are: ifType = ethernetCsmacd(6).
cdaiIfConfigEntry	1.3.6.1.4.1.9.9.374.1.3.1.1		not-accessible	A row instance contains the configuration to enable or disable trust state for Dynamic ARP Inspection at each physical interface capable of this feature.
T/F cdaiIfTrustEnable	1.3.6.1.4.1.9.9.374.1.3.1.1.1	TruthValue	read-write	This object indicates whether the interface is trusted for Dynamic ARP Inspection purpose. If this object is set to 'true', the interface is trusted. ARP packets coming to this interface will be forwarded without checking. If this object is set to 'false', the interface is not trusted. ARP packets coming to this interface will be subjected to ARP inspection.
cdaiIfRateLimitTable	1.3.6.1.4.1.9.9.374.1.3.2		not-accessible	A table provides the mechanism to configure the rate limit for Dynamic ARP Inspection purpose at each physical interface capable of this feature.
cdaiIfRateLimitEntry	1.3.6.1.4.1.9.9.374.1.3.2.1		not-accessible	A row instance contains the configuration of rate limit Dynamic ARP Inspection at each physical interface capable of this feature.
U32 cdaiIfRateLimit	1.3.6.1.4.1.9.9.374.1.3.2.1.1	Unsigned32	read-write	This object indicates rate limit value for Dynamic ARP Inspection purpose. If the incoming rate of ARP packets exceeds the value of this object, ARP packets will be dropped.
cdaiStatistics	1.3.6.1.4.1.9.9.374.1.4
cdaiVlanStatsTable	1.3.6.1.4.1.9.9.374.1.4.1		not-accessible	A table lists the Dynamic Arp Inspection statistics per VLAN.
cdaiVlanStatsEntry	1.3.6.1.4.1.9.9.374.1.4.1.1		not-accessible	A row instance contains Dynamic ARP Inspection statistics information for each VLAN.
VLA cdaiVlanStatsIndex	1.3.6.1.4.1.9.9.374.1.4.1.1.1	VlanIndex	not-accessible	This object indicates the VLAN number.
C32 cdaiVlanForwardedEx	1.3.6.1.4.1.9.9.374.1.4.1.1.2	Counter32	read-only	This object indicates the number of ARP packets forwarded by Dynamic Arp Inspection feature.
C32 cdaiVlanDropped	1.3.6.1.4.1.9.9.374.1.4.1.1.3	Counter32	read-only	This object indicates the number of ARP packets dropped by Dynamic ARP Inspection feature.
C32 cdaiVlanAclPermitted	1.3.6.1.4.1.9.9.374.1.4.1.1.4	Counter32	read-only	This object indicates the number of ARP packets permitted by the configured ACL.
C32 cdaiVlanDhcpBindingsPermitted	1.3.6.1.4.1.9.9.374.1.4.1.1.5	Counter32	read-only	This object indicates the number of DHCP-binding permitted ARP packets.
C32 cdaiVlanAclDenied	1.3.6.1.4.1.9.9.374.1.4.1.1.6	Counter32	read-only	This object indicates the number of ARP packets denied by the configured ACL.
C32 cdaiVlanDhcpBindingDenied	1.3.6.1.4.1.9.9.374.1.4.1.1.7	Counter32	read-only	This object indicates the number of DHCP-binding denied ARP packets.
C32 cdaiVlanSrcMacValidationFailures	1.3.6.1.4.1.9.9.374.1.4.1.1.8	Counter32	read-only	This object indicates the number of ARP packets that fail source MAC address validation.
C32 cdaiVlanDestMacValidationFailures	1.3.6.1.4.1.9.9.374.1.4.1.1.9	Counter32	read-only	This object indicates the number of ARP packets that fail destination MAC address validation.
C32 cdaiVlanIpValidationFailures	1.3.6.1.4.1.9.9.374.1.4.1.1.10	Counter32	read-only	This object indicates the number of ARP packets that fail IP validation.
C32 cdaiVlanArpProbePermitted	1.3.6.1.4.1.9.9.374.1.4.1.1.11	Counter32	read-only	This object indicates the number of ARP Probe packets that are permitted.
C32 cdaiVlanInvalidProtocolData	1.3.6.1.4.1.9.9.374.1.4.1.1.12	Counter32	read-only	This object indicates the number of ARP packets that contain invalid protocol data.
cdaiMIBConformance	1.3.6.1.4.1.9.9.374.2
cdaiMIBCompliances	1.3.6.1.4.1.9.9.374.2.1
cdaiMIBCompliance	1.3.6.1.4.1.9.9.374.2.1.1			The compliance statement for CISCO-DYNAMIC-ARP-INSPECTION-MIB. This compliance is superceded by cdaiMIBCompliance1.
cdaiMIBCompliance1	1.3.6.1.4.1.9.9.374.2.1.2			The compliance statement for CISCO-DYNAMIC-ARP-INSPECTION-MIB
cdaiMIBGroups	1.3.6.1.4.1.9.9.374.2.2
cdaiGlobalLoggingGroup	1.3.6.1.4.1.9.9.374.2.2.1			A collection of object which is used to configure Dynamic ARP Inspection logging.
cdaiVlanConfigGroup	1.3.6.1.4.1.9.9.374.2.2.2			A collection of object which are used to configure as well as show information regarding the Dynamic ARP Inspection feature per VLAN.
cdaiIfConfigGroup	1.3.6.1.4.1.9.9.374.2.2.3			A collection of object which are used to configure as well as show information regarding the interface trust state for Dynamic ARP Inspection purpose.
cdaiIfRateLimitGroup	1.3.6.1.4.1.9.9.374.2.2.4			A collection of object which are used to configure as well as show information regarding the rate limit per interface for Dynamic ARP Inspection purpose.
cdaiLoggingConfigGroup	1.3.6.1.4.1.9.9.374.2.2.5			A collection of object which provides logging configuration for Dynamic ARP Inspection feature.
cdaiAddressValidationGroup	1.3.6.1.4.1.9.9.374.2.2.6			A collection of object which provides address validation configuration for Dynamic ARP Inspection feature.
cdaiVlanCfgGroup	1.3.6.1.4.1.9.9.374.2.2.7			A collection of object which provides additional VLAN configuration for Dynamic ARP Inspection feature.
cdaiVlanStatisticsGroup	1.3.6.1.4.1.9.9.374.2.2.8			A collection of object which provides Dynamic ARP Inspection statistics per VLAN.
cdaiLogBufferGroup	1.3.6.1.4.1.9.9.374.2.2.9			A collection of object which provides logging information for Dynamic ARP Inspection feature.
cdaiVlanExtStatisticsGroup	1.3.6.1.4.1.9.9.374.2.2.10			A collection of object which provides additional Dynamic ARP Inspection statistics per VLAN.
cdaiVlanArpProbeGroup	1.3.6.1.4.1.9.9.374.2.2.11			A collection of object which provides additional VLAN configuration for ARP Probe packets.
cdaiLogBufferActionGroup	1.3.6.1.4.1.9.9.374.2.2.12			A collection of object which provides log buffer action.

RFC description

Cisco private MIB managing Dynamic ARP Inspection (DAI) feature for detecting and preventing ARP spoofing attacks.

Start monitoring Cisco Catalyst switches with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCO-DYNAMIC-ARP-INSPECTION-MIB