Stop the rogue DHCP server
Protect the VLAN 1 LAN from a rogue DHCP server:
- Turn on DHCP snooping for VLAN 1.
- Trust only the uplink to the real server (Gi0/1).
- The Cisco server (R1) drops option-82 packets, so switch option 82 off.
- Confirm PC1 still gets a DHCP address and appears in the binding table.
How it works: this is VulnTech NetLab, a network simulator running in your browser. Click a device in the diagram to open its console and type commands, just like on real equipment (? shows help, Tab finishes a word). Click a cable to inspect it. Tasks tick themselves off as you complete them; questions are answered in the box under each task. Your work is kept if you reload; Reset starts the network over.
Solution explanation
With the uplink trusted and every other port untrusted, a rogue server on fa0/1 - fa0/3 would have its OFFER and ACK dropped, while the real server's answers over Gi0/1 get through. Turning off option 82 lets the Cisco router accept the snooped request.
Show solution
[SW1]
enable
configure terminal
ip dhcp snooping
ip dhcp snooping vlan 1
no ip dhcp snooping information option
interface g0/1
ip dhcp snooping trust
end
[PC1]
sudo dhclient eth0
[SW1]
show ip dhcp snooping binding