DHCP Snooping and Layer 2 Security

A user brings in a personal Wi-Fi router and plugs it into a wall jack. The router has DHCP enabled by default and starts answering DHCP requests faster than the legitimate server. Devices connecting to that segment get IPs pointing to the personal router as their gateway. All internet traffic for those devices now flows through the user's home router — which is logging it, potentially modifying it, and definitely not secure. DHCP snooping stops this by refusing DHCP replies from any port except those explicitly trusted.

DHCP snooping works by classifying every port as trusted or untrusted. DHCP DISCOVER, REQUEST, and other client messages are allowed from untrusted ports. DHCP OFFER and ACK (server messages) are only allowed in from trusted ports. Since servers only respond, any OFFER arriving on an untrusted port is a violation — the frame is dropped and the port is logged.

#The Trust/Untrust Model#link

The default is that every port is untrusted. When you enable DHCP snooping globally, the switch behaves as if every port might be hostile. You then explicitly trust the ports where legitimate DHCP servers sit — typically uplinks to distribution and direct connections to servers. Everything else stays untrusted.

#Configuring DHCP Snooping#link

#The Binding Table#link

The binding table maps MAC address, IP address, VLAN, and interface for every client that has received an IP from a trusted DHCP server. It's the authoritative source of 'who is on which port with which IP.' Two other features — Dynamic ARP Inspection and IP Source Guard — rely on this table to enforce policy at Layer 2.

#Check Your Understanding#link