What is DHCP Snooping and why enable it?

DHCP Snooping is a security feature that filters untrusted DHCP messages and builds a binding database, protecting against rogue DHCP servers and DHCP starvation attacks.

The Threats

• Rogue DHCP server: Attacker's server hands out malicious gateway/DNS
• DHCP starvation: Exhausts DHCP pool with fake requests
• MITM attacks: Using rogue DHCP to intercept traffic

How It Works

1. Ports classified as trusted (uplinks, DHCP server) or untrusted (access)
2. DHCP server responses (OFFER, ACK) allowed only from trusted ports
3. Client requests (DISCOVER, REQUEST) allowed from untrusted ports
4. Switch builds DHCP snooping binding table (IP↔MAC↔Port↔VLAN)

Related Features Enabled by Snooping

• Dynamic ARP Inspection (DAI): Validates ARP based on binding table
• IP Source Guard: Blocks spoofed source IP traffic
• Option 82 support: Passes port info to DHCP server

Configuration Example

ip dhcp snooping\nip dhcp snooping vlan 10,20\ninterface Gi0/1  ! uplink to DHCP server\n  ip dhcp snooping trust

Best Practices

• Only trust ports connecting to legitimate DHCP servers
• Enable on all client VLANs
• Configure rate limiting to prevent DHCP flooding
• Combine with DAI and IP Source Guard for full protection
• Regularly review binding table

Common Pitfalls

• Forgetting to trust uplinks — clients can't get IP
• Missing Option 82 handling on DHCP server
• Not covering all VLANs