DHCP Snooping — Rogue Servers & the Binding Table

The switch becomes an active DHCP referee: untrusted ports (all by default) may send Discover/Request; Offers and ACKs only come from trusted ports. Rogue DHCP server on a desk switch simply gets its replies dropped. ip dhcp snooping ip dhcp snooping vlan 10,20 interface Gi1/0/24 ip dhcp snooping trust ! optional armour: ip dhcp snooping […]

SLAAC vs DHCPv6

SLAAC Stateless DHCPv6 Stateful DHCPv6 Address from client itself client (RA prefix) server DNS no yes yes RA flags M=0 O=0 M=0 O=1 M=1 SLAAC: Router Solicitation → Router Advertisement (prefix + gateway as the router’s link-local) → client builds its Interface ID (EUI-64 or privacy random) → DAD. No server, no logs, and only […]

DHCP — DORA, Relay & Options

UDP 67 (server) / 68 (client). IPv4 clients start with a broadcast DORA: Discover → Offer → Request → Ack. Renew unicast at 50 % of the lease, broadcast at 87.5 %, full DORA when expired. Relay — the cross-subnet piece Broadcasts die at routers, so the first L3 hop relays: ip helper-address 192.168.100.10 converts […]