Understanding DHCP Snooping

DHCP Snooping is a crucial network security feature implemented on switches to protect against rogue DHCP servers. These malicious servers can disrupt network operations by assigning incorrect IP addresses or intercepting traffic. By enforcing strict control over DHCP communications, DHCP Snooping ensures only authorized servers can distribute IP addresses, maintaining network integrity and security.

Key Points

• DHCP Snooping prevents rogue DHCP servers from manipulating IP address assignments.
• Core Mechanism: Differentiates between trusted (server) and untrusted (client) ports.
• Critical Components: Packet filtering rules, DHCP Binding Table, and integration with DAI/IP Source Guard.
• Implementation: Requires careful configuration of trusted ports and VLANs.
• Maintenance: Regularly verify the binding table and security logs.

Why DHCP Snooping Matters

DHCP (Dynamic Host Configuration Protocol) automates IP address assignment, but this convenience comes with risks. A rogue DHCP server can:

• Assign fraudulent IP addresses, causing connectivity issues
• Redirect traffic to malicious destinations (e.g., phishing sites)
• Launch man-in-the-middle attacks by intercepting data
• Exhaust IP address pools, leading to denial-of-service conditions

Without DHCP Snooping, any device on your network could impersonate a DHCP server and manipulate your entire IP infrastructure.

How DHCP Snooping Works

Trusted vs. Untrusted Ports

DHCP Snooping classifies switch ports into two categories:

Port Type	Description	Example Devices
Trusted	Permitted to send DHCP server responses (OFFER/ACK)	Legitimate DHCP servers
Untrusted	Blocked from sending DHCP server responses; only allowed to send requests	End-user devices (PCs, phones)

Best Practice: Always configure uplink ports (connecting to other switches/routers) as trusted to prevent accidental blocking of legitimate DHCP traffic.

Packet Filtering Mechanism

The switch inspects DHCP packets and enforces these rules:

Allowed Packets:

• DHCP server responses (OFFER/ACK) from trusted ports
• DHCP requests (DISCOVER/REQUEST) from any port
• Packets with consistent MAC/IP bindings

Blocked Packets:

• DHCP server responses from untrusted ports
• Packets with mismatched MAC addresses (e.g., DHCP request from MAC A but response to MAC B)
• Packets with invalid relay agent information
• DHCP RELEASE/DECLINE messages from untrusted ports (prevents IP address hijacking)

The DHCP Snooping Binding Database

The switch maintains a real-time DHCP Binding Table that records:

| MAC Address       | IP Address  | Lease Time | VLAN | Interface  |
|-------------------|-------------|------------|------|------------|
| 00:1A:2B:3C:4D:5E | 192.168.1.10| 86400      | 10   | Gi1/0/5    |

Key Uses of the Binding Table:

• Dynamic ARP Inspection (DAI): Validates ARP requests against the table to prevent ARP spoofing
• IP Source Guard: Restricts IP traffic to only those IPs listed in the table
• Troubleshooting: Identifies devices with DHCP-assigned IPs

Implementation Example

Basic Cisco Switch Configuration

Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10
Switch(config)# interface GigabitEthernet1/0/1
Switch(config-if)# ip dhcp snooping trust  // Trusted port (DHCP server)
Switch(config-if)# exit
Switch(config)# interface range GigabitEthernet1/0/2-24
Switch(config-if-range)# no ip dhcp snooping trust  // Untrusted ports

Verification Commands

Switch# show ip dhcp snooping
Switch# show ip dhcp snooping binding
Switch# debug ip dhcp snooping packet

Common Misconfigurations to Avoid

1. Forgetting to trust uplink ports

   • Symptom: Legitimate DHCP traffic from other subnets gets blocked
   • Fix: Always trust ports connecting to other switches/routers

2. Not enabling DHCP Snooping on all VLANs

   • Symptom: Rogue servers operate in unprotected VLANs
   • Fix: Apply ip dhcp snooping vlan [range] to all relevant VLANs

3. Overlooking rate limiting

   • Symptom: DHCP starvation attacks exhaust IP pools
   • Fix: Configure ip dhcp snooping limit rate [packets-per-second] on untrusted ports

4. Ignoring the binding database

   • Symptom: Security features like DAI fail to work properly
   • Fix: Ensure the database is persistent across reboots with ip dhcp snooping database [flash:/file]

Integration with Other Security Features

Feature	How It Works with DHCP Snooping	Benefit
Dynamic ARP Inspection	Validates ARP packets against DHCP binding table	Prevents ARP spoofing attacks
IP Source Guard	Filters traffic based on DHCP binding table entries	Blocks IP spoofing
Port Security	Limits MAC addresses per port	Prevents MAC flooding attacks
802.1X Authentication	Ensures only authenticated devices get DHCP addresses	Adds layer of access control

Real-World Attack Scenario

Attack: A malicious insider connects a Raspberry Pi configured as a rogue DHCP server to an unprotected port.

Without DHCP Snooping:

• The rogue server assigns itself as the default gateway (192.168.1.254)
• All client traffic routes through the attacker's device
• The attacker captures sensitive data (passwords, emails) via packet sniffing

With DHCP Snooping:

• The switch detects DHCP server responses from an untrusted port
• The rogue packets are dropped immediately
• The legitimate DHCP server (192.168.1.1) continues serving clients
• Security logs record the attempted attack for investigation

Key Takeaways

• Primary Purpose: DHCP Snooping prevents rogue DHCP servers from manipulating IP address assignments
• Core Mechanism: Differentiates between trusted (server) and untrusted (client) ports
• Critical Components:
  • Packet filtering rules
  • DHCP Binding Table
  • Integration with DAI/IP Source Guard
• Implementation: Requires careful configuration of trusted ports and VLANs
• Maintenance: Regularly verify the binding table and security logs

Learn More

Advanced Topics

• DHCP Option 82: Learn how to use relay agent information for granular control
• DHCP Snooping in Virtual Networks: Implementation in VMware NSX and Cisco ACI
• Troubleshooting: Common issues and debug commands for enterprise environments

Recommended Resources

• Cisco DHCP Snooping Configuration Guide
• RFC 7513 - DHCP Snooping and IP Source Guard
• Network Security Bible (2nd Edition) - Chapter 12: Switch Security

Hands-On Practice

1. Set up a lab with:
   • 1 switch (Cisco, Juniper, or open-source alternative)
   • 1 legitimate DHCP server
   • 1 rogue DHCP server (e.g., Kali Linux with dnsmasq)
   • 1 client device
2. Configure DHCP Snooping and observe how it blocks the rogue server
3. Experiment with rate limiting and binding table persistence