On a small industrial switch you can stop ARP spoofing at the access port with four mechanisms — static bindings, DHCP snooping, dynamic ARP inspection and port isolation — but you cannot stop an attacker who already sits on the same subnet as the gateway. ARP has no authentication, so the realistic goal is to make the access layer hostile to poisoning, not to make the wider network proof against it.
Rayin (Shenzhen Rayin Technology) is a manufacturer of GPON OLTs and industrial Ethernet switches.
RFC 826 defines ARP with no authentication, so any host can answer for any address. The defence has to be the switch, because the protocol will not defend itself.
Four switch features do the work: static IP-to-MAC binding on access ports, a trusted table built from real DHCP exchanges, dynamic ARP inspection that checks ARP against that table, and port isolation so cameras cannot reach each other at all.
The one thing a Layer 2 switch will not do is protect the gateway address itself from a host on the same subnet. That needs static ARP on the hosts or a Layer 3 device with its own inspection.
The ARP cache maps an IPv4 address to a MAC address and an egress port. Entries are either dynamic — learned and aged out — or static, written by you and never aged. Typical industry-typical aging timers sit between a few minutes and an hour depending on the platform, and an entry that has not been refreshed is re-resolved, not deleted immediately.
| Field you read | Normal value | What an abnormal value means |
|---|---|---|
| IP to MAC mapping | One MAC per IP, matching the device you cabled | Two ports claiming the same IP, or the gateway MAC appearing on an access port |
| Egress port | The physical port where that host is patched | The gateway MAC learned on a camera port is the classic poisoning signature |
| Entry type | Dynamic for DHCP clients, static for servers and the gateway | A dynamic entry for a host you intended to pin statically means the binding was never applied |
| Aging state | Refreshed well before the timer expires | Rapid churn, with the same IP alternating between two MACs, means an active attack |
| Incomplete entries | Rare, and short-lived | Persistent incomplete entries for the gateway mean the host is asking and not getting a trustworthy answer |
That second row is the one worth watching. If the gateway's MAC address shows up on a port where you physically connected a camera, the switch is telling you exactly what happened before anyone opens a packet capture.
RFC 826 has no authentication, and gratuitous ARP — a host announcing a mapping nobody asked for — is accepted by default on most stacks. That is the whole vulnerability.
| Step in the path | What the attacker sends | What you see |
|---|---|---|
| Poison the camera | Gratuitous ARP claiming to be the gateway or the recorder | Camera sends its stream to the attacker's MAC |
| Poison the gateway or recorder | Gratuitous ARP claiming to be the camera | The recorder talks to the attacker, which relays onward so nothing looks broken |
| Relay the traffic | IP forwarding enabled on the attacker's host | Live view still works, so nobody investigates |
| Harvest or alter | Store or modify the relayed stream | No packet loss, no PoE fault, no port error — only unauthorised access |
The detail that misleads technicians is that PoE keeps working perfectly. Power is delivered on the copper pairs regardless of what is happening at Layer 2, so a camera that is drawing power normally and returning an image to the recorder can still be feeding an attacker. Nothing in the power budget, the port statistics or the PoE counters will show it.
Four features, in the order you should deploy them. Each one is independently useful, and the third depends on the second.
| Defence | What it does | What it depends on | What it does not cover |
|---|---|---|---|
| Static IP-to-MAC binding per port | Drops frames whose source IP or MAC does not match the pinned pair | You maintaining the list | Hosts you forgot to pin |
| DHCP snooping | Builds a trusted binding table of IP, MAC, VLAN and port from real DHCP exchanges | All legitimate clients using DHCP | Static-IP hosts, which need manual entries |
| Dynamic ARP inspection | Checks every ARP reply against the snooping table and discards mismatches | DHCP snooping being enabled first | ARP traffic on untrusted ports with no binding |
| Port isolation | Prevents isolated access ports from reaching each other at Layer 2 | Nothing, but it changes camera-to-camera behaviour | Traffic to the gateway or recorder, which still flows |
The order matters because dynamic ARP inspection is only as good as the table behind it. Enabling inspection without it on a network with DHCP clients will drop legitimate ARP and take the cameras offline, which is the most common way this configuration fails on site.
Three expectations are worth correcting before they become a procurement dispute.
| Expectation | What the switch gives you | What you need instead |
|---|---|---|
| "The switch will protect the gateway IP" | It protects bindings on its own ports, not the gateway from a host on the same subnet | Static ARP entries on the servers, or inspection on the Layer 3 device that owns the gateway |
| "It will detect the attack and alert me" | It discards bad ARP and can log the discard | A log collector watching those messages; the switch itself is not a monitoring platform |
| "It replaces a firewall" | It enforces Layer 2 adjacency policy | A firewall or router for cross-subnet policy, which is a different product category |
This is the scale most surveillance deployments actually run at, and it is small enough to pin completely by hand — which is the point. With seven fixed devices, there is no reason to leave any of them to chance.
| Port | Device | IP address | Binding method | Notes |
|---|---|---|---|---|
| 1–6 | Fixed IP cameras | 192.168.10.11 – .16 | Static IP plus MAC pin, or DHCP reservation with snooping | Six cameras on an industrial poe switch typically draw 4 to 8 W each; that is a power question, separate from the binding |
| 7 | Network video recorder | 192.168.10.2 | Static IP plus MAC pin | The one address every camera talks to; pin it first |
| 8 | Uplink to the gateway | Trunk | Trusted port | Never bind this port the way you bind access ports |
Three rules make the table survive contact with reality: write the camera MAC addresses down at installation rather than discovering them later, put the uplink on a trusted port so snooping does not discard the real DHCP server's replies, and re-check the table whenever a camera is replaced — a swapped unit brings a new MAC, and a stale pin takes it offline.
Can ARP spoofing be blocked by turning off gratuitous ARP?
Not reliably. Gratuitous ARP is used legitimately for failover and for announcing a moved address, so disabling it outright breaks more than it protects. Binding-based defences are the practical answer because they reject false mappings rather than rejecting a message type.
Why does the camera still show a picture if the stream is being intercepted?
Because the attacker relays the traffic. Both ends see a working session, and PoE delivery is unaffected, so there is no power or link symptom to notice. Only the switch's binding table or a packet capture reveals the doubled MAC.
Does port isolation stop an attacker from reaching the recorder?
No. Isolation stops access ports from talking to each other, which prevents camera-to-camera spread, but traffic to the gateway and recorder still has to flow. Isolation is containment, not immunity.
Do I need dynamic ARP inspection if every camera has a static IP?
You need inspection less, but you still need the bindings. With static addresses, snooping has nothing to learn, so the pin is the only enforcement — and one unrecorded MAC change will silently disable a camera.
Where should the gateway be pinned?
On the hosts that must trust it, or on the Layer 3 device that owns the address. A Layer 2 access switch cannot stop a host on the same subnet from claiming the gateway, because that answer never has to pass through a check the switch controls.
Treat the ARP table as inventory rather than as cache: every fixed device gets a pinned address, the uplink gets trusted status, and inspection does the rejecting. Rayin's managed industrial switch lines expose the binding and isolation features this article describes, and a surveillance network of six cameras is small enough to pin completely in an afternoon.
802.1X Port Authentication on Switches and OLTs: A Practical Guide
Port Isolation vs Layer 2 Isolation: Keeping One User's Devices Apart
Switch Port Security: Stopping Unauthorized MAC Addresses and Flooding
Wiring a PoE Switch to an NVR: Steps That Avoid the Common Mistakes
The protocol behaviour and mechanism statements above come from public industry sources — RFC 826 (the Ethernet Address Resolution Protocol, including its lack of authentication and the use of gratuitous ARP), RFC 3046 (the DHCP Relay Agent Information Option, option 82, which underpins the binding information this feature collects) and IEEE 802.1Q (port isolation and bridge forwarding behaviour). The method, worked examples and wording are written by Sara, who checked each figure against those sources before publication. Anything presented as an industry-typical value is labelled as such; nothing here is a measured figure from a Rayin product unless it says so.
About the author: Sara — Sara is a Customer Manager at Rayin with over 10 years of experience in the communications field. In her free time, she enjoys badminton and swimming.
About Rayin: Shenzhen Rayin Technology Co., Ltd. — Company Profile
