DHCP snooping

A real-life situation

On Monday morning half the users on VLAN 10 can't reach the internet. Their PCs have addresses, but from the wrong range: 192.168.0.x with a gateway of 192.168.0.1. Someone has plugged a home wireless router into a desk socket (Gi1/0/5). Its built-in DHCP server is answering requests faster than R1, and every PC that takes its offer now sends traffic to a box that goes nowhere. An attacker could do the same thing on purpose and make their own laptop the gateway, so all traffic flows through it.

What DHCP snooping is

DHCP snooping is a switch feature that inspects DHCP messages and decides which ports may act as DHCP servers. (For how DHCP itself works, see the DHCP lesson.) It does three jobs:

1. Blocks rogue servers. Server messages are only accepted on trusted ports.
2. Records who got which address. It builds the DHCP snooping binding table: one entry per lease, with the client's MAC address, IP address, VLAN, port and lease time.
3. Limits DHCP floods. It can cap how many DHCP messages per second a port may send.

Every port is untrusted by default. You mark as trusted only the ports that lead to a legitimate DHCP server.

Why it works that way

DHCP has no built-in way to prove a server is genuine. A client simply takes the first offer. The switch, however, knows something the client doesn't: which port each message came in on. Real servers sit behind the uplink, never behind a desk socket. So the switch can apply a simple rule based on direction:

The RELEASE and DECLINE check stops a different trick: an attacker sending a fake RELEASE on behalf of a victim to cancel the victim's lease. The switch also checks by default that the frame's source MAC matches the client MAC inside the DHCP message, which makes it harder to fake many clients.

Because the switch watches every successful exchange, it ends up with a reliable list of "this IP belongs to this MAC on this port". That list is the binding table, and other features trust it. ARP security explains how Dynamic ARP Inspection (DAI) checks every ARP message against it, and IP Source Guard uses it to filter spoofed source IPs.

How it works step by step

Here is a normal lease through SW1, with snooping on for VLAN 10. Tap a message to see what the switch checks.

And here is what happens to the rogue server once snooping is on:

How to configure it on Cisco IOS

⚠️ Based on Cisco IOS / IOS XE documentation, not run on a lab device. Configure the trusted uplink before or together with enabling snooping, or clients lose their leases at renewal time.

Option 82 in one paragraph

Option 82 (the relay agent information option) is a field the switch can add to client requests, saying which switch and port the request came from. A server can use it to pick an address. Cisco switches add it by default when snooping is on. The catch: the switch is not a real relay, so the packet has option 82 but an empty relay address (giaddr 0.0.0.0). A Cisco IOS DHCP server rejects that combination, and clients get no address. Either disable insertion on the switch (as above) or, on the router, accept it with ip dhcp relay information trusted on the LAN interface.

Full example for SW1 and R1

How to verify it

SW1#show ip dhcp snooping
Switch DHCP snooping is enabled
DHCP snooping is configured on following VLANs:
10
DHCP snooping is operational on following VLANs:
10
...
Insertion of option 82 is disabled
...
Verification of hwaddr field is enabled
...
Interface                  Trusted    Allow option    Rate limit (pps)
-----------------------    -------    ------------    ----------------
GigabitEthernet1/0/1       no         no              15
GigabitEthernet1/0/2       no         no              15
GigabitEthernet1/0/24      yes        yes             unlimited

SW1#show ip dhcp snooping binding
MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface
------------------  ---------------  ----------  -------------  ----  --------------------
00:11:22:33:44:55   192.168.10.20    86012       dhcp-snooping   10    GigabitEthernet1/0/1
00:11:22:33:66:77   192.168.10.21    85377       dhcp-snooping   10    GigabitEthernet1/0/2
Total number of bindings: 2

When the rogue server tries again, SW1 logs the drop:

%DHCP_SNOOPING-5-DHCP_SNOOPING_UNTRUSTED_PORT: DHCP_SNOOPING drop message on untrusted port, message type: DHCPOFFER, MAC sa: 00aa.bbcc.0005

What goes wrong and how to troubleshoot it

%PM-4-ERR_DISABLE: dhcp-rate-limit error detected on Gi1/0/5, putting Gi1/0/5 in err-disable state

Common mistakes

• Trusting user ports "to be safe". A trusted port can host a rogue server; trust only the path to the real one.
• Forgetting the uplink between two switches. If the DHCP server is behind another switch, the trunk toward it must be trusted on every switch on the way.
• Enabling snooping globally but not per VLAN (or the reverse).
• Setting a rate limit on the trusted uplink as low as on user ports. The uplink carries replies for everyone.
• Turning on Dynamic ARP Inspection before the binding table has filled up, which blocks legitimate hosts.

💡 Exam tip: know that all ports are untrusted by default, that untrusted ports drop server messages (OFFER, ACK, NAK), and that you trust the port toward the real server. Expect a question linking DHCP snooping to DAI: DAI validates ARP against the DHCP snooping binding table. Also remember that ip dhcp snooping vlan is needed as well as the global command, and that exceeding ip dhcp snooping limit rate err-disables the port.

Key takeaways

• DHCP snooping blocks DHCP server messages on untrusted ports, which is every port by default.
• Trust only ports that lead to a legitimate DHCP server.
• It builds a binding table (MAC, IP, VLAN, port, lease) from ACKs it sees.
• Dynamic ARP Inspection and IP Source Guard rely on that table.
• Rate limiting stops DHCP starvation by err-disabling a flooding port.

Check yourself