Dynamic ARP Inspection primarily protects ARP messages at which network layer?

• A. Physical layer
• B. Application layer
• C. Network layer
• D. Data link layer

Answer: (D)

ARP is the mechanism used to map IP addresses to MAC addresses on the local network, and these ARP messages ride inside Ethernet frames on the data link layer. Dynamic ARP Inspection sits in the switch and checks ARP packets as they traverse the local segment, validating them against trusted bindings learned from DHCP snooping or static entries. If an ARP packet claims an IP-to-MAC mapping that doesn’t match the trusted data, it’s blocked, preventing spoofing at the point where the frames are actually forwarded. That’s why this protection operates at the data link layer.