???? What is DHCP?

DHCP (Dynamic Host Configuration Protocol) automatically provides network configuration information to devices.

A DHCP server can provide information such as:

• IP Address
• Subnet Mask
• Default Gateway
• DNS Server
• Lease Information

Client
   |
   ↓
DHCP Server
   |
   +---- IP Address
   +---- Subnet Mask
   +---- Default Gateway
   +---- DNS Server
        

???? What is a Rogue DHCP Server?

A rogue DHCP server is an unauthorized DHCP server connected to a network.

Normally, clients should receive DHCP configuration from the organization's legitimate DHCP server.

However, if an unauthorized device starts responding to DHCP requests, clients may accept the incorrect configuration.

              Legitimate DHCP Server
                       |
                       ↓
                    Switch
                       |
        +--------------+--------------+
        |              |              |
        ↓              ↓              ↓
      PC 1            PC 2           PC 3


              Attacker
                 |
                 ↓
          Rogue DHCP Server
                 |
                 ↓
               Switch
                 |
                 ↓
        Fake DHCP Configuration
        

⚠️ How Does a Rogue DHCP Attack Work?

A simplified rogue DHCP scenario can look like this:

Step 1 — Client Requests an IP Address

Client
  |
  | DHCP Discover
  ↓
Network
        

Step 2 — DHCP Servers Respond

                Network
               /       \
              ↓         ↓
     Legitimate DHCP   Rogue DHCP
          Server          Server
              \           /
               \         /
                ↓       ↓
                  Client
        

Step 3 — Client Accepts a DHCP Offer

Depending on network conditions and timing, the client may accept an offer from an unauthorized DHCP server.

Step 4 — Incorrect Configuration

IP Address:
192.168.1.50

Default Gateway:
Attacker-controlled gateway

DNS Server:
Unauthorized DNS server
        

This can potentially allow an attacker to interfere with network traffic or redirect users toward malicious infrastructure.

???? Why is a Rogue DHCP Server Dangerous?

DHCP controls important network configuration. If an attacker can influence that configuration, they may be able to create serious security and connectivity problems.

• Traffic Redirection: A malicious gateway can potentially redirect network traffic.
• DNS Manipulation: A rogue DNS server could provide incorrect DNS responses.
• Network Disruption: Incorrect IP configuration can prevent users from accessing network resources.
• Man-in-the-Middle Risk: A malicious gateway can potentially place an attacker in the communication path.
• Security Bypass: Incorrect network configuration can undermine existing security controls.

????️ What is DHCP Snooping?

DHCP Snooping is a Layer 2 security feature supported by many managed network switches.

It allows the switch to distinguish between trusted and untrusted ports for DHCP traffic.

                 DHCP Server
                      |
                      ↓
                Trusted Port
                      |
                      ↓
                   Switch
                 /       \
                /         \
               ↓           ↓
         Untrusted      Untrusted
            Port           Port
               |             |
               ↓             ↓
              PC            PC
        

The basic idea is that legitimate DHCP server traffic should come through trusted interfaces, while unauthorized DHCP server responses arriving from untrusted interfaces can be blocked.

???? Trusted vs Untrusted Ports

✅ Trusted Port

A trusted port is an interface through which legitimate DHCP server responses are expected to arrive.

DHCP Server
     |
     ↓
Trusted Switch Port
     |
     ↓
Switch
     |
     ↓
Clients
        

❌ Untrusted Port

Client-facing ports are commonly configured as untrusted for DHCP snooping purposes.

Attacker Device
      |
      ↓
Untrusted Port
      |
      ↓
Switch
      |
      X
DHCP Server Response Blocked
        

This prevents an unauthorized device connected to a client port from acting as a DHCP server through that interface.

???? How DHCP Snooping Works

              Legitimate DHCP Server
                       |
                       ↓
                 TRUSTED PORT
                       |
                       ↓
                    Switch
                       |
          +------------+------------+
          |                         |
          ↓                         ↓
    UNTRUSTED PORT             UNTRUSTED PORT
          |                         |
          ↓                         ↓
        PC 1                    PC 2


              Attacker
                 |
                 ↓
          UNTRUSTED PORT
                 |
                 ↓
               Switch
                 |
                 X
        Unauthorized DHCP
        server responses blocked
        

The switch examines DHCP messages and applies its configured DHCP snooping rules.

???? DHCP Snooping Binding Table

Many switches can build a DHCP Snooping Binding Table.

The table can associate information such as:

• MAC Address
• Assigned IP Address
• VLAN
• Switch Interface
• Lease Information

DHCP Snooping Binding Table

MAC Address        IP Address       VLAN    Port
--------------------------------------------------
AA:BB:CC:11:22:33  192.168.1.10     10      Gi0/1
AA:BB:CC:44:55:66  192.168.1.11     10      Gi0/2
AA:BB:CC:77:88:99  192.168.1.12     10      Gi0/3
        

This information can also be used by other switch security features, depending on the platform and configuration.

???? DHCP Snooping and Other Security Features

DHCP snooping can serve as a foundation for additional Layer 2 security mechanisms on supported network platforms.

DHCP Snooping + Dynamic ARP Inspection

Dynamic ARP Inspection (DAI) can use DHCP snooping information to help validate ARP messages.

DHCP Snooping
      |
      ↓
Binding Information
      |
      ↓
Dynamic ARP Inspection
      |
      ↓
Validate ARP Traffic
        

DHCP Snooping + IP Source Guard

IP Source Guard can use learned binding information to help restrict traffic using unauthorized source IP addresses on supported switches.

DHCP Snooping
      |
      ↓
Binding Table
      |
      +----------+
      |          |
      ↓          ↓
     DAI     IP Source Guard
      |          |
      ↓          ↓
 Layer 2 Security
        

???? DHCP Snooping in an Enterprise Network

Imagine an organization with multiple departments connected to managed switches.

                  DHCP Server
                       |
                       ↓
                 Core Switch
                       |
                Trusted Interface
                       |
                       ↓
               Access Switch
              /      |       \
             /       |        \
            ↓        ↓         ↓
          PC 1      PC 2      PC 3
        Untrusted Untrusted  Untrusted
        

If someone connects an unauthorized DHCP server to an access port, DHCP snooping can help prevent its server responses from being accepted through that untrusted interface.

⚙️ Cisco Configuration Example

On supported Cisco switches, DHCP snooping can be enabled for selected VLANs and the interface toward the legitimate DHCP server can be marked as trusted.

Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10

Switch(config)# interface GigabitEthernet0/24
Switch(config-if)# ip dhcp snooping trust
        

Client-facing interfaces generally remain untrusted by default when DHCP snooping is enabled, unless the network administrator explicitly configures otherwise.

⚠️ Always verify the correct DHCP server-facing interface before applying a trusted-port configuration in a production network.

???? Useful Verification Commands

Network administrators can inspect DHCP snooping status and learned bindings using platform-specific commands.

show ip dhcp snooping
        

To view learned DHCP snooping bindings on supported Cisco platforms:

show ip dhcp snooping binding
        

These commands can help administrators verify whether DHCP snooping is enabled and whether expected client bindings are being learned.

⚠️ Important Configuration Considerations

• Correctly identify legitimate DHCP server paths.
• Configure trusted interfaces carefully.
• Keep client-facing interfaces untrusted unless there is a specific reason to trust them.
• Monitor DHCP snooping logs and unexpected DHCP activity.
• Test the configuration before deploying it across a large production network.
• Consider DHCP relay configurations when DHCP servers are located on different networks.

???? Easy Way to Remember DHCP Snooping

Legitimate DHCP Server
          |
          ↓
    TRUSTED PORT
          |
          ↓
        SWITCH
          |
          ↓
      CLIENTS


Rogue DHCP Server
          |
          ↓
  UNTRUSTED PORT
          |
          ↓
        SWITCH
          |
          X
   DHCP Response Blocked
        

Think of DHCP Snooping as a security guard checking which switch ports are allowed to provide DHCP server responses. ????

???? Test Your Networking Knowledge

What is the primary purpose of DHCP Snooping?

1. Increase Internet speed
2. Prevent unauthorized DHCP server responses
3. Convert IPv4 addresses to MAC addresses
4. Encrypt DNS queries

???? Key Takeaways

• DHCP automatically provides network configuration to clients.
• A rogue DHCP server is an unauthorized DHCP server connected to the network.
• Rogue DHCP servers can provide incorrect IP addresses, gateways, or DNS server information.
• DHCP Snooping is a Layer 2 switch security feature designed to help block unauthorized DHCP server responses.
• Trusted ports are used for legitimate DHCP server paths.
• Untrusted ports are typically used for client-facing interfaces.
• DHCP snooping can maintain a binding table containing client IP, MAC, VLAN, and interface information.
• DHCP snooping information can support additional security features such as Dynamic ARP Inspection and IP Source Guard on supported platforms.

Learn DHCP Snooping, VLANs, ARP, routing, and switching to build a strong foundation in network security. ????