AI-Assisted Distributed Layer-2 Intelligence and Microsegmentation (DL2IM)
A Software-Defined Layer-2 Architecture for Intelligent Endpoint Discovery, ARP/NDP Suppression, Distributed Security Enforcement, and AI-Assisted Microsegmentation
Technology Concept Paper
Author: Christopher Soans
Date: August 2026
|
| Figure 1. AI-Assisted Distributed Layer-2 Intelligence and Microsegmentation (DL2IM) |
Executive Summary
Traditional Ethernet switching was designed around relatively simple forwarding principles. A Layer-2 switch learns source MAC addresses, associates them with physical or logical interfaces, and floods traffic when the destination is unknown or when protocols intentionally use broadcast or multicast communication.
IPv4 Address Resolution Protocol (ARP) and IPv6 Neighbor Discovery Protocol (NDP) are fundamental examples. Although effective, these mechanisms can generate significant broadcast or multicast traffic and provide opportunities for spoofing, poisoning, lateral movement, and other security problems.
This paper proposes an AI-Assisted Distributed Layer-2 Intelligence and Microsegmentation architecture (DL2IM) in which software-defined Ethernet switches are enhanced with endpoint intelligence, trusted IP-to-MAC bindings, ARP and NDP suppression, distributed security enforcement, and connectivity to a dedicated AI Intelligence/Control Network.
A central component of the architecture is an Endpoint Binding Database (EBD) maintained locally by each intelligent switch. Rather than functioning merely as a conventional MAC-address table or ARP/NDP cache, the EBD associates endpoint network addresses with physical connectivity, VLAN membership, authenticated identity, security classification, application identity where available, and trust state.
Each participating VLAN can additionally be assigned a Virtual Endpoint Discovery Interface (VEDI). Unlike a conventional Switch Virtual Interface (SVI), the VEDI is not intended to route user traffic or become the VLAN's default gateway. Its purpose is to give the switch a persistent logical presence within the VLAN for endpoint discovery, reachability verification, ARP/NDP participation, and maintenance of the Endpoint Binding Database.
This approach allows endpoint information to be derived from multiple independent sources rather than relying exclusively upon passive observation or periodic active communications. Once a destination binding has been validated, the switch can respond locally to appropriate ARP and IPv6 Neighbor Discovery requests, substantially reducing unnecessary Layer-2 flooding.
More importantly, the same endpoint intelligence can be integrated with distributed policy enforcement so that security policy applies even when two communicating systems reside on the same VLAN and physical Ethernet switch. The resulting architecture moves significant security intelligence from traditional network boundaries toward the point at which endpoints actually attach to the network.
1. The Problem with Traditional Layer-2 Networks
Ethernet switching remains dependent upon several mechanisms developed when networks were considerably smaller and endpoint identity was relatively unimportant.
A conventional switch primarily maintains relationships such as:
MAC Address
|
+---- VLAN
|
+---- Switch Port
IP address information is generally maintained elsewhere or learned indirectly. When an IPv4 endpoint needs the Ethernet address corresponding to another IPv4 address on its local subnet, it normally issues an ARP broadcast:
Host A
"Who has 10.20.30.25?"
|
v
Ethernet Switch
|
+----+----+----+
| | | |
v v v v
Host B C D E
The request is distributed throughout the broadcast domain even though only one system possesses the requested address. IPv6 eliminates ARP but still requires Neighbor Discovery, which uses multicast Neighbor Solicitation and Neighbor Advertisement messages.
Large Layer-2 domains can consequently produce substantial amounts of discovery traffic. More importantly, conventional Layer-2 communication can bypass security controls located at Layer-3 boundaries.
Server A -------- Ethernet Switch -------- Server B
If two systems reside within the same subnet, their traffic may never traverse a router or traditional firewall. This creates a significant challenge for microsegmentation and east-west security.
2. Proposed Architecture
DL2IM enhances software-defined Layer-2 switches with several integrated functions:
- Intelligent endpoint discovery
- Authoritative endpoint binding
- ARP suppression
- IPv6 NDP suppression
- Endpoint validation
- Distributed security enforcement
- AI-assisted anomaly detection
- Application-aware policy where endpoint operating systems provide application identity
- Coordination through a separate AI Intelligence/Control Network
The switch remains capable of normal Layer-2 forwarding, but its forwarding decisions are augmented by significantly richer information.
AI Intelligence/
Control Network
|
|
AI Controller
|
Global Endpoint Graph
|
+---------------+---------------+
| | |
v v v
DL2IM SW1 DL2IM SW2 DL2IM SW3
| | |
Endpoints Endpoints Endpoints
The controller provides global intelligence while switches retain the ability to make routine forwarding and security decisions locally. This distinction is essential for performance and resiliency.
3. Endpoint Binding Database
The Endpoint Binding Database is the central local intelligence structure within a DL2IM switch. Instead of maintaining only:
MAC -> Port
the switch could maintain:
VLAN
|
+-- Physical/Logical Port
|
+-- MAC Address
|
+-- IPv4 Address
+-- IPv6 Address
+-- Endpoint Identity
+-- Authentication State
+-- Device Classification
+-- Security Group
+-- Application Identity
+-- Trust Level
+-- Discovery Sources
+-- Last Verified Time
A conceptual entry might appear as:
VLAN: 120
Port: Ethernet1/17
MAC: 00:21:5A:81:42:10
IPv4: 10.120.5.21
IPv6: 2001:db8:120::21
Endpoint: SERVER-3921
Security Group: Finance-App
Authentication: Verified
Trust State: Trusted
Discovery Sources: DHCP + 802.1X + ARP + VEDI
Last Verified: 08:12:37
Multiple information sources are important because no single discovery mechanism should automatically be considered authoritative.
4. Virtual Endpoint Discovery Interface
A conventional SVI normally represents a Layer-3 interface associated with a VLAN. For example:
interface vlan 100
IP address 10.100.0.1
Hosts might use that address as their default gateway. DL2IM introduces a different concept.
Virtual Endpoint Discovery Interface - VEDI
A VEDI gives the intelligent switch a stable logical presence within a VLAN without requiring the switch to perform normal inter-VLAN routing.
VLAN 100
Subnet: 10.100.0.0/24
Default Gateway:
10.100.0.1
DL2IM VEDI:
10.100.0.254
The VEDI does not replace the default gateway and does not advertise itself as the default gateway. Instead, it provides the switch with a controlled local identity for endpoint discovery, validation, and maintenance of endpoint state.
VLAN 100
|
+----------------+----------------+
| | |
Host A Host B Host C
| | |
+----------------+----------------+
|
DL2IM Switch
|
VEDI .254
|
Endpoint Discovery
|
v
Endpoint Binding Database
5. Why a VEDI Is Preferable to Passive Learning Alone
A switch that only observes traffic can learn substantial endpoint information, but passive learning has limitations. An endpoint may remain silent for an extended period, change addresses, migrate, disconnect without generating traffic, or be impersonated by a malicious system.
Passive Sources
- Ethernet source addresses
- ARP
- IPv6 Neighbor Discovery
- DHCP
- DHCPv6
- 1X authentication
- Router Advertisements
- SLAAC activity
Infrastructure Sources
- DHCP servers
- Authentication systems
- Network-access-control platforms
- Hypervisors
- Container platforms
- AI controllers
- Network orchestration systems
Active Validation
The VEDI provides a third mechanism. The switch can selectively verify endpoint reachability and identity when information becomes stale, contradictory, or suspicious.
Passive Observation
+
Infrastructure Information
+
Authenticated Identity
+
VEDI Active Validation
+
AI Correlation
|
v
Endpoint Binding Database
This produces a considerably stronger database than conventional ARP or MAC learning alone.
6. Confidence-Based Endpoint Binding
Not every learned relationship should carry the same trust. DL2IM can therefore assign confidence or trust states to endpoint bindings.
MAC observation only
|
v
UNVERIFIED
MAC + ARP/NDP
|
v
OBSERVED
MAC + DHCP
|
v
VALIDATED
MAC + DHCP + 802.1X
|
v
AUTHENTICATED
Authenticated +
VEDI verification +
AI consistency
|
v
TRUSTED
AI does not replace deterministic security validation. Instead, AI assists with correlation, anomaly detection, stale-binding identification, behavioral analysis, and decisions about when additional validation is appropriate. Cryptographic identity, authenticated network access, DHCP bindings, and deterministic security policy remain authoritative wherever possible.
7. Intelligent ARP Suppression
When Host A needs to reach Host B, a traditional Ethernet switch floods the ARP broadcast. A DL2IM switch first consults its EBD.
ARP Request
|
v
DL2IM Switch
|
v
Endpoint Binding Lookup
|
+---- Unknown/Untrusted
| |
| v
| Controlled normal
| discovery process
|
+---- Trusted Binding
|
v
Local ARP Response
If the switch possesses a sufficiently trusted binding, it can respond appropriately without flooding the request throughout the VLAN. This converts many broadcast discovery operations into localized transactions.
8. IPv6 Neighbor Discovery Suppression
IPv6 requires more careful treatment. Neighbor Discovery performs functions beyond simple IPv4 ARP replacement, including Neighbor Solicitation, Neighbor Advertisement, Router Solicitation, Router Advertisement, Duplicate Address Detection, Neighbor Unreachability Detection, and address autoconfiguration interactions.
Consequently, DL2IM should not indiscriminately suppress NDP multicast. Instead, the switch becomes NDP-aware.
IPv6 Neighbor Solicitation
|
v
DL2IM Switch
|
Trusted EBD?
/ \
Yes No
| |
v v
Controlled Standards-
response compliant ND
Functions such as Duplicate Address Detection and Neighbor Unreachability Detection must continue operating correctly. The architecture can therefore build upon concepts represented by ND inspection, RA Guard, DHCPv6 Guard, and EVPN ND suppression while adding richer endpoint intelligence.
9. Layer-2 Microsegmentation
The security implications may be more important than the reduction in broadcast traffic. Two systems on the same VLAN may ordinarily communicate without crossing a Layer-3 security boundary.
Server A
10.1.1.10
|
v
DL2IM Switch
|
v
Server B
10.1.1.20
With DL2IM, the ingress switch can validate source identity and apply distributed security policy before forwarding.
Server A
|
v
Ingress Port
|
+--> Validate Source MAC
+--> Validate Source IP
+--> Determine Endpoint Identity
+--> Determine Security Group
+--> Determine Application Identity
|
v
Distributed Security Policy
|
+--+-----------+-------------+
| | |
ALLOW DENY INSPECT
| | |
v X v
Server B Security Service
Security therefore follows the endpoint rather than depending entirely upon network topology.
10. Identity-Based Security
Traditional network policy frequently uses source IP, destination IP, protocol, and port. DL2IM can support richer relationships based on endpoint identity, security group, application identity, destination identity, and permitted service.
Payroll-Web
|
| TCP 5432
v
Payroll-Database
ALLOW
Payroll-Web
|
| SSH
v
Payroll-Database
DENY
This remains enforceable even if both workloads occupy the same VLAN.
11. Integration with an AI-Aware Operating System
The architecture becomes considerably more powerful when integrated with an AI-aware host operating system. The operating system could securely provide application, process, container or VM, IP address, MAC address, and physical host information.
Application
|
Process/Container
|
Server Identity
|
IP Address
|
MAC Address
|
VLAN
|
Physical Switch Port
|
Security Policy
The AI Intelligence/Control Network can then maintain a network-wide endpoint and application graph.
12. Distributed Security Enforcement
The architecture should avoid forwarding every decision to a central AI controller.
AI Controller
|
| Policy + Intelligence
v
DL2IM Switch
|
| Local Enforcement
v
Production Traffic
The switch maintains locally cached endpoint bindings, security policy, identity mappings, application mappings, trust states, and recently validated controller information. This provides line-rate enforcement while minimizing control-plane dependence.
13. AI Intelligence/Control Network
The separate AI Intelligence/Control Network provides communication between network devices and AI controllers. A conceptual deployment could use IPv6.
AI Intelligence Network
IPv6
|
+--------+--------+
| |
AI Controller Backup Controller
|
+--------+--------+--------+
| | |
Switch 1 Switch 2 Switch 3
Production traffic does not normally traverse this network. It carries endpoint state, security policy, topology, authentication information, binding changes, anomaly notifications, device health, application identity, threat intelligence, and policy updates.
14. Protection Against ARP Spoofing
If an attacker advertises a false IP-to-MAC relationship but the EBD contains a trusted infrastructure binding, the switch can detect the contradiction.
False ARP Advertisement
|
v
DL2IM
|
EBD Check
|
MISMATCH
|
+-----+------+----------+
| | |
DROP ALERT QUARANTINE
The controller can then correlate similar activity elsewhere in the network.
15. IPv6 Security
Similar protection can be applied to IPv6. DL2IM can identify suspicious Neighbor Advertisements, Router Advertisements, Neighbor Solicitation behavior, Duplicate Address attempts, address changes, and MAC/IP inconsistencies.
An unauthorized endpoint attempting to advertise itself as an IPv6 router could be blocked using deterministic policy, while the AI layer analyzes whether the event represents misconfiguration, compromise, or coordinated malicious activity.
16. Endpoint Mobility
Modern environments frequently move workloads. A virtual machine might move from one switch and port to another.
Switch A / Port 10
|
v
Switch C / Port 27
Instead of assuming an attack whenever a MAC or IP appears elsewhere, the architecture can correlate hypervisor migration, authentication, switch learning, VEDI validation, controller topology, and endpoint identity. The resulting binding can then be safely moved.
17. Failure and Fallback Behavior
The AI controller must not become a single point of failure. If the AI Intelligence/Control Network becomes unavailable, the switch continues using its last validated endpoint bindings, security policies, authentication state, ARP/NDP information, and local forwarding information.
Known + Trusted
|
v
Continue Normally
Unknown
|
v
Restricted Discovery
Suspicious
|
v
Quarantine
Ordinary Layer-2 connectivity therefore does not require continuous AI-controller availability.
18. Policy Validation Before Deployment
This architecture integrates naturally with a virtual network-device validation plane. Before distributing a major policy change, the AI controller could test it against virtual representations of the switches.
Proposed Policy
|
v
AI Simulation / Validation
|
v
Synthetic Traffic
|
v
Expected Result?
/ \
Yes No
| |
v X
Deploy Reject
This reduces the risk associated with automated policy changes.
19. Reduced Dependence on VLANs as Security Boundaries
VLANs remain useful for broadcast-domain management, operational separation, compatibility, and failure containment. However, DL2IM reduces the need to treat VLAN membership itself as the primary security identity.
Endpoint Identity
+
Application Identity
+
Security Group
+
Policy
The network topology and security topology can therefore evolve more independently. This may permit larger or simpler Layer-2 domains without sacrificing endpoint-level segmentation. It does not imply eliminating VLANs; broadcast containment, operational isolation, fault domains, multicast behavior, and compatibility remain valid reasons for maintaining them.
20. Hardware Architecture
A future DL2IM-capable switch could contain traditional switching ASICs alongside policy enforcement, endpoint binding, and AI/DPU processing functions.
+--------------------------------------------------+
| DL2IM Switch |
| |
| +----------------------+ |
| | Traditional ASIC | |
| | Packet Forwarding | |
| +----------+-----------+ |
| | |
| +----------v-----------+ |
| | Policy Enforcement | |
| | Engine | |
| +----------+-----------+ |
| | |
| +----------v-----------+ |
| | Endpoint Binding | |
| | Engine | |
| +----------+-----------+ |
| | |
| +----------v-----------+ |
| | AI / DPU Processor | |
| +----------+-----------+ |
| | |
| +----------v-----------+ |
| | AI Intelligence | |
| | Network Interface | |
| +----------------------+ |
+--------------------------------------------------+
Time-sensitive packet forwarding remains within switching hardware. More computationally intensive functions can be handled by a DPU, NPU, embedded AI accelerator, or control processor.
21. Standards Compatibility
The architecture should be designed as an enhancement to open networking standards rather than a proprietary replacement for Ethernet, ARP, IPv6, or existing routing protocols.
- IEEE 802.1Q
- IEEE 802.1X
- ARP
- IPv6 Neighbor Discovery
- DHCP/DHCPv6
- IPv6 SLAAC
- EVPN
- VXLAN
- RA Guard
- DHCP snooping
- Dynamic ARP Inspection concepts
- Secure Neighbor Discovery concepts
- Software-defined networking interfaces
Existing endpoints should continue functioning without requiring modifications. Enhanced endpoints and AI-aware operating systems can provide additional identity information but should not be mandatory for basic connectivity.
22. Incremental Deployment
Phase 1 - Enhanced Learning
Deploy intelligent switches capable of constructing the Endpoint Binding Database.
Phase 2 - VEDI
Enable Virtual Endpoint Discovery Interfaces for more reliable endpoint verification.
Phase 3 - ARP/NDP Suppression
Allow validated bindings to reduce unnecessary discovery flooding.
Phase 4 - Distributed Security
Deploy endpoint-aware Layer-2 microsegmentation.
Phase 5 - AI Controller Integration
Connect switches through the dedicated AI Intelligence/Control Network.
Phase 6 - Application Awareness
Integrate AI-aware operating systems, hypervisors, and container environments.
This permits conventional devices to coexist with increasingly intelligent infrastructure.
23. Key Architectural Principle
The most important distinction in DL2IM is the separation of intelligence from forwarding dependency.
AI assists the network in understanding:
What is connected?
Who is it?
Where is it?
What application is communicating?
Is the behavior expected?
What policy should apply?
The local switch still determines at line rate:
Forward
Drop
Rate-limit
Mirror
Quarantine
Inspect
This creates a distributed architecture rather than turning the central AI controller into an inline forwarding device.
24. Architectural Summary
AI INTELLIGENCE / CONTROL NETWORK
|
AI Controller
|
Global Endpoint Graph
|
Security / Application Policy
|
+-----------------+----------------+
| |
DL2IM Switch DL2IM Switch
| |
+------+------+ +------+------+
| | | | | |
VEDI EBD Policy VEDI EBD Policy
| | Engine | | Engine
+------+------+ +------+------+
| |
VLAN / Hosts VLAN / Hosts
At the endpoint level:
Endpoint
|
v
Physical Switch Port
|
v
Endpoint Binding
|
+--> MAC
+--> IPv4
+--> IPv6
+--> VLAN
+--> Identity
+--> Application
+--> Trust
|
v
Security Policy
|
v
Forwarding Decision
25. Conclusion
AI-Assisted Distributed Layer-2 Intelligence and Microsegmentation extends software-defined switching beyond traditional MAC-based forwarding.
By introducing an Endpoint Binding Database, Virtual Endpoint Discovery Interfaces, intelligent ARP/NDP suppression, identity-aware forwarding, and distributed security enforcement, the Layer-2 access network becomes an active component of the security architecture.
The Virtual Endpoint Discovery Interface is particularly important because it provides each switch with a stable logical presence within its participating VLANs without requiring that interface to become a conventional Layer-3 gateway.
This allows endpoint state to be maintained through a combination of passive learning, infrastructure information, authenticated identity, active verification, and AI-assisted correlation.
The architecture consequently addresses two separate problems simultaneously. First, it can reduce unnecessary ARP broadcast and IPv6 Neighbor Discovery multicast traffic. Second, and potentially more significantly, it enables security policy to be enforced at the point where traffic enters the network - even when source and destination reside within the same Layer-2 broadcast domain.
Combined with an AI Intelligence/Control Network, AI-enhanced network devices, and AI-aware operating systems, DL2IM provides the foundation for a network in which endpoint identity, application identity, physical attachment, network addressing, and security policy become part of a unified distributed intelligence model.
Rather than requiring traffic to reach a centralized firewall before the network understands what is communicating, the network can begin making informed security decisions at the first intelligent Layer-2 switch through which the traffic passes.
© 2026 Christopher Soans. All rights reserved.
This work is licensed under a Creative Commons Attribution 4.0 International License (CC BY 4.0).
