two cisco features that kill lan man in the middle attacks

the two lan attacks nobody's watching for

everyone's obsessed with firewalls and endpoint detection, meanwhile layer 2 sits there wide open. two of the oldest tricks in the book, a rogue dhcp server and arp spoofing, still work on a shocking number of networks in 2024. both let an attacker sitting on your lan quietly become the man in the middle for every device around them. no exploit needed, no malware, just the switch doing exactly what switches were designed to do: trust everyone equally.

how the rogue dhcp attack actually works

every device that joins your network broadcasts a dhcp request looking for an ip address. normally your real dhcp server answers first and hands out the correct gateway and dns info. but dhcp is a race. if an attacker plugs in a laptop running a fake dhcp server and it answers faster than your real one, the victim device happily accepts it. now that victim's default gateway and dns server point straight at the attacker's machine. every bit of traffic, browsing, logins, internal app traffic, routes through them first. no alarms go off because from the client's perspective, everything looks normal, it just got an ip address like it always does.

how arp spoofing works alongside it

arp is the protocol that maps ip addresses to mac addresses on the local network. the problem is arp has zero authentication built in. any device can send an arp reply claiming "hey, i'm 192.168.1.1" and other devices on the segment will just update their arp table and believe it. an attacker floods the network with forged arp replies claiming to be the gateway, and now every device sends its traffic to the attacker's mac address instead of the real router. combine this with a rogue dhcp server and you've got a fully intercepted lan segment, both directions, without touching a single endpoint.

dhcp snooping shuts down the fake server

cisco switches fix this with a feature called dhcp snooping. the concept is simple: you tell the switch which port the real dhcp server lives on and mark that as a trusted port. every other port on the vlan becomes untrusted, meaning the switch will drop any dhcp server responses coming from those ports. it doesn't matter how fast the rogue server answers, if it's plugged into an untrusted port, its dhcp offers get silently dropped before they ever reach a client. the switch also builds a binding table of legit ip-to-mac-to-port mappings from the trusted responses, which becomes important for the next feature.

dynamic arp inspection shuts down the spoofing

dynamic arp inspection, or dai, uses that same dhcp snooping binding table to validate arp traffic. when a device sends an arp packet, the switch checks it against the binding table. if the ip-to-mac pairing doesn't match what the switch already knows is legitimate, the arp packet gets dropped on the spot. so an attacker sending forged "i am the gateway" arp replies just gets ignored by the switch, because the switch already knows the real gateway's mac address and the fake one doesn't match. this is why dai depends on dhcp snooping being enabled first, it needs that trusted table to compare against.

how it actually gets configured

both features are enabled per vlan, and you designate the uplink port toward your real dhcp server and router as the trusted port. everything else, the access ports where user devices, laptops, and random plug-ins live, stays untrusted by default. that's the whole point, you're not trusting devices, you're trusting known trusted infrastructure.

ip dhcp snooping
ip dhcp snooping vlan 10
interface gig0/1
 ip dhcp snooping trust

ip arp inspection vlan 10
interface gig0/1
 ip arp inspection trust

that's it. two features, a handful of lines, and both classic mitm attacks stop working on that segment entirely.

the takeaway

if you're running cisco switches and haven't touched dhcp snooping or dai, you're one rogue laptop away from someone reading every packet on your lan. these aren't exotic features, they're built into ios, they cost nothing, and they take maybe ten minutes to configure per vlan. check your switch configs, find your trusted uplinks, turn these on, and go test it yourself with a rogue dhcp server on a lab vlan before someone else tests it for you.