Security
DHCP Snooping
DHCP snooping filters DHCP messages on a switch to prevent rogue DHCP servers and builds a binding table used by other security features like Dynamic ARP Inspection.
What you need to know
- Ports connected to legitimate DHCP servers must be configured as trusted; all other ports are untrusted by default.
- Untrusted ports will drop DHCP server messages (OFFER, ACK, NAK) received on them.
- DHCP snooping must be enabled globally (ip dhcp snooping) and per VLAN (ip dhcp snooping vlan X) to take effect.
- The DHCP snooping binding table records untrusted host MAC, IP, lease time, VLAN, and interface.
- Rate limiting (ip dhcp snooping limit rate) on untrusted ports mitigates DHCP starvation attacks.
- Option 82 (relay agent information) can be inserted or stripped by the switch; ip dhcp snooping information option controls this.
- Dynamic ARP Inspection and IP Source Guard both depend on the DHCP snooping binding table to function correctly.
Configuration commands
| Command | Mode | Purpose |
|---|---|---|
| ip dhcp snooping | config | Enable DHCP snooping globally on the switch. |
| ip dhcp snooping vlan 10,20 | config | Enable DHCP snooping for specific VLANs. |
| no ip dhcp snooping information option | config | Disable insertion of option 82 relay information if not needed downstream. |
| interface gi0/1 | config | Enter the interface connected to the legitimate DHCP server. |
| ip dhcp snooping trust | config-if | Mark the interface as trusted so DHCP server messages are allowed. |
| interface range fa0/1 - 24 | config | Enter a range of access ports connected to end hosts. |
| ip dhcp snooping limit rate 10 | config-if | Limit incoming DHCP messages to 10 packets per second on untrusted ports. |
Verify it
- show ip dhcp snooping
- show ip dhcp snooping binding
- show ip dhcp snooping statistics
- show running-config | section dhcp snooping
Common mistakes
- Enabling DHCP snooping globally but forgetting the per-VLAN command, so it has no effect.
- Forgetting to trust the uplink or server-facing port, causing legitimate DHCP replies to be dropped.
- Not setting a rate limit on untrusted ports, leaving the switch exposed to DHCP starvation.
- Enabling Dynamic ARP Inspection or IP Source Guard without DHCP snooping active, breaking connectivity since the binding table never populates.
- Applying trust to access ports facing end users instead of only the server/uplink port.
Practise DHCP Snooping in a real CLI
Generated labs, graded against the simulated network state.