VulnTech DHCP snooping | CCNA Exam Prep

A rogue DHCP server (a laptop running one, deliberately or by accident) can answer DISCOVERs faster than the real server and hand out itself as the default gateway, so all the victim's traffic flows through the attacker. DHCP snooping stops this.

Every port is untrusted by default. On an untrusted port the switch drops DHCP server messages (OFFER, ACK, NAK) - a client should never send those. You trust only the ports toward the real server (the uplink). The switch also records a binding (MAC, IP, VLAN, port) from each ACK it allows, building the table that DAI and IP source guard rely on.

Command	Where	Does
`ip dhcp snooping`	Global	Turn snooping on
`ip dhcp snooping vlan 10`	Global	Snoop these VLANs
`ip dhcp snooping trust`	Interface (uplink)	Trust DHCP from this port
`no ip dhcp snooping information option`	Global	Stop adding option 82 (often needed, see below)
`show ip dhcp snooping`		What's on, which ports are trusted
`show ip dhcp snooping binding`		The learned MAC/IP/port table

In NetLab

▶ SW1
SW1>enable
SW1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
SW1(config)#ip dhcp snooping
SW1(config)#ip dhcp snooping vlan 1
SW1(config)#no ip dhcp snooping information option
SW1(config)#interface g0/1
SW1(config-if)#ip dhcp snooping trust
SW1(config-if)#end
*Mar  1 00:00:08.000: %SYS-5-CONFIG_I: Configured from console by console
▶ PC1
student@PC1:~$ sudo dhclient eth0
student@PC1:~$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:1a:33:d5:62:b1 brd ff:ff:ff:ff:ff:ff
    inet 10.1.1.10/24 brd 10.1.1.255 scope global dynamic eth0
       valid_lft 86399sec preferred_lft 86399sec
    inet6 fe80::21a:33ff:fed5:62b1/64 scope link 
       valid_lft forever preferred_lft forever
▶ SW1
SW1#show ip dhcp snooping
Switch DHCP snooping is enabled
DHCP snooping is configured on following VLANs:
1
Insertion of option 82 is disabled

Interface                  Trusted    Rate limit (pps)
------------------------   -------    ----------------
Gi0/1                      yes        unlimited
SW1#show ip dhcp snooping binding
MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface
------------------  ---------------  ----------  -------------  ----  --------------------
00:1a:33:d5:62:b1   10.1.1.10        86400       dhcp-snooping  1     Fa0/1
Total number of bindings: 1

Tip: Option 82: by default a snooping switch stamps client messages with extra information (option 82). A Cisco IOS DHCP server then drops those packets because they carry the option but the relay address is 0. On a simple LAN where the server is a Cisco router, either no ip dhcp snooping information option on the switch, or ip dhcp relay information trusted on the server, fixes it.

Common mistake: Forgetting to trust the uplink port breaks DHCP for everyone: the real server's OFFER arrives on an untrusted port and is dropped. Trust the port toward the server.