Understanding DHCP Snooping

DHCP Snooping is a critical network security feature that protects against rogue DHCP servers by enforcing strict control over DHCP communications. By distinguishing between trusted and untrusted ports, it ensures only authorized servers can distribute IP addresses, maintaining network integrity and preventing malicious attacks like IP spoofing or traffic interception.

---

Why DHCP Snooping Matters

DHCP (Dynamic Host Configuration Protocol) automates IP address assignment, but this convenience introduces security risks. A rogue DHCP server can:

• Assign fraudulent IP addresses, causing connectivity issues
• Redirect traffic to malicious destinations (e.g., phishing sites)
• Launch man-in-the-middle attacks by intercepting data
• Exhaust IP address pools, leading to denial-of-service conditions

Without DHCP Snooping, any device on your network could impersonate a DHCP server and manipulate your entire IP infrastructure.

---

How DHCP Snooping Works

Trusted vs. Untrusted Ports

DHCP Snooping classifies switch ports into two categories:

Port Type	Description	Example Devices
Trusted	Permitted to send DHCP server responses (OFFER/ACK)	Legitimate DHCP servers
Untrusted	Blocked from sending DHCP server responses; only allowed to send requests	End-user devices (PCs, phones)

Best Practice: Always configure uplink ports (connecting to other switches/routers) as trusted to prevent accidental blocking of legitimate DHCP traffic.

Packet Filtering Rules

The switch inspects DHCP packets and enforces these rules:

Allowed Packets:

• DHCP server responses (OFFER/ACK) from trusted ports
• DHCP requests (DISCOVER/REQUEST) from any port
• Packets with consistent MAC/IP bindings

Blocked Packets:

• DHCP server responses from untrusted ports
• Packets with mismatched MAC addresses
• Packets with invalid relay agent information
• DHCP RELEASE/DECLINE messages from untrusted ports

The DHCP Snooping Binding Database

The switch maintains a real-time DHCP Binding Table that records:

| MAC Address       | IP Address  | Lease Time | VLAN | Interface  |
|-------------------|-------------|------------|------|------------|
| 00:1A:2B:3C:4D:5E | 192.168.1.10| 86400      | 10   | Gi1/0/5    |

Key Uses of the Binding Table:

• Validates ARP requests (via Dynamic ARP Inspection)
• Restricts IP traffic (via IP Source Guard)
• Identifies devices with DHCP-assigned IPs for troubleshooting

---

Implementation Guide

Basic Cisco Switch Configuration

Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10
Switch(config)# interface GigabitEthernet1/0/1
Switch(config-if)# ip dhcp snooping trust  // Trusted port (DHCP server)
Switch(config-if)# exit
Switch(config)# interface range GigabitEthernet1/0/2-24
Switch(config-if-range)# no ip dhcp snooping trust  // Untrusted ports

Verification Commands

Switch# show ip dhcp snooping
Switch# show ip dhcp snooping binding
Switch# debug ip dhcp snooping packet

---

Common Misconfigurations to Avoid

1. Forgetting to trust uplink ports

   • Symptom: Legitimate DHCP traffic from other subnets gets blocked
   • Fix: Trust ports connecting to other switches/routers

2. Not enabling DHCP Snooping on all VLANs

   • Symptom: Rogue servers operate in unprotected VLANs
   • Fix: Apply ip dhcp snooping vlan [range] to all relevant VLANs

3. Overlooking rate limiting

   • Symptom: DHCP starvation attacks exhaust IP pools
   • Fix: Configure ip dhcp snooping limit rate [packets-per-second] on untrusted ports

4. Ignoring the binding database

   • Symptom: Security features like DAI fail to work properly
   • Fix: Ensure persistence with ip dhcp snooping database [flash:/file]

---

Integration with Other Security Features

Feature	How It Works with DHCP Snooping	Benefit
Dynamic ARP Inspection	Validates ARP packets against DHCP binding table	Prevents ARP spoofing attacks
IP Source Guard	Filters traffic based on DHCP binding table entries	Blocks IP spoofing
Port Security	Limits MAC addresses per port	Prevents MAC flooding attacks
802.1X Authentication	Ensures only authenticated devices get DHCP addresses	Adds layer of access control

---

Real-World Attack Scenario

Attack: A malicious insider connects a Raspberry Pi configured as a rogue DHCP server to an unprotected port.

Without DHCP Snooping:

• The rogue server assigns itself as the default gateway (192.168.1.254)
• All client traffic routes through the attacker’s device
• The attacker captures sensitive data via packet sniffing

With DHCP Snooping:

• The switch detects DHCP server responses from an untrusted port
• Rogue packets are dropped immediately
• The legitimate DHCP server continues serving clients
• Security logs record the attempted attack

---

Key Takeaways

• Primary Purpose: Prevents rogue DHCP servers from manipulating IP assignments
• Core Mechanism: Differentiates between trusted (server) and untrusted (client) ports
• Critical Components:
  • Packet filtering rules
  • DHCP Binding Table
  • Integration with DAI/IP Source Guard
• Implementation: Requires careful configuration of trusted ports and VLANs
• Maintenance: Regularly verify the binding table and security logs

---

Learn More

Advanced Topics

• DHCP Option 82: Relay agent information for granular control
• DHCP Snooping in Virtual Networks: Implementation in VMware NSX and Cisco ACI
• Troubleshooting: Debug commands for enterprise environments

Recommended Resources

• Cisco DHCP Snooping Configuration Guide
• RFC 7513 - DHCP Snooping and IP Source Guard
• Network Security Bible (2nd Edition) - Chapter 12: Switch Security

Hands-On Practice

1. Set up a lab with:
   • 1 switch (Cisco, Juniper, or open-source alternative)
   • 1 legitimate DHCP server
   • 1 rogue DHCP server (e.g., Kali Linux with dnsmasq)
   • 1 client device
2. Configure DHCP Snooping and observe how it blocks the rogue server
3. Experiment with rate limiting and binding table persistence