DHCP snooping is a Layer 2 security feature that protects against rogue DHCP servers by only allowing DHCP server traffic on trusted switch ports.

Facts

Point	Description
OSI layer	Layer 2
Purpose	Protect against DHCP spoofing
Default	Disabled; all ports untrusted
Port types	Trusted / untrusted
Binding table	IP ↔ MAC ↔ VLAN ↔ interface
Used by	Dynamic ARP Inspection, IP source guard

How it works

The switch changes from passive forwarder to active inspector of DHCP traffic:

1. Client sends DHCP Discover (broadcast) – allowed from untrusted ports
2. Offer/ACK may only come from trusted ports
3. The switch builds the DHCP snooping binding table: client MAC, assigned IP, VLAN, interface, lease time

What problem does it solve?

Without it an attacker can run a rogue DHCP server and hand out a wrong gateway/DNS → man-in-the-middle, eavesdropping, DoS. With snooping only authorized servers may answer; rogue responses are dropped; the network keeps control over IP assignment.

Mechanism	Explanation
Trusted ports	Only these may send DHCP Offer/ACK
Untrusted ports	Clients may only send Discover/Request
Rate limiting	Protects against DHCP starvation
Binding table	Truth source for later traffic validation

Extra features

• Rate limiting: ip dhcp snooping limit rate 10 – max 10 DHCP packets/s per port (starvation protection)
• Option 82: switch inserts interface/VLAN info – some DHCP servers need no ip dhcp snooping information option
• Foundation for: DAI, IP source guard, IPv4 first-hop security

Configuration

ip dhcp snooping
ip dhcp snooping vlan 10
!
interface GigabitEthernet0/1            ! uplink toward the DHCP server
 ip dhcp snooping trust
!
interface range GigabitEthernet0/2 - 24  ! recommended on client ports
 ip dhcp snooping limit rate 15

Verification

show ip dhcp snooping
show ip dhcp snooping binding
show running-config | section dhcp

Typical faults: DHCP not working → wrong trusted port; no IP → VLAN not enabled; client blocked → rate limit too low.

Typical campus design: uplink to router = trusted, access ports = untrusted, trunk between switches = trusted.