What Is DHCP Snooping? How Does It Stop Rogue DHCP Servers?

What Is DHCP Snooping? How Does It Stop Rogue DHCP Servers?
Networking ATN Campus October 02, 2026 33 views

What Is DHCP Snooping? How Does It Stop Rogue DHCP Servers?

DHCP automatically provides devices with important network configuration such as IP addresses, subnet masks, default gateways, and DNS server information.

But what happens if an unauthorized DHCP server is connected to the network? A rogue DHCP server can provide incorrect network settings to clients and cause connectivity or security problems.

DHCP Snooping is a Layer 2 switch security feature designed to help protect DHCP communication by distinguishing between trusted and untrusted switch ports.

```

What Is DHCP?

```

Dynamic Host Configuration Protocol (DHCP) allows network clients to obtain configuration information automatically.

A DHCP server can provide:

  • IP address
  • Subnet mask
  • Default gateway
  • DNS server information
  • Lease information
   Client
     |
     | DHCP
     |
     v
DHCP Server
     |
     +---- IP Address
     +---- Subnet Mask
     +---- Gateway
     +---- DNS
```

What Is a Rogue DHCP Server?

```

A rogue DHCP server is an unauthorized DHCP server that responds to DHCP clients. 

         Network
            |
      +-----+-----+
      |           |
  Legit DHCP   Rogue DHCP
   Server        Server
      |           |
      +-----+-----+
            |
         Clients

If clients receive DHCP responses from the rogue server, they may receive incorrect configuration.

```

What Problems Can a Rogue DHCP Server Cause?

```

A rogue DHCP server might provide clients with:

  • An incorrect IP address
  • An incorrect default gateway
  • An incorrect DNS server
  • Incorrect network configuration

Depending on the configuration, this can cause connectivity problems or create security risks.

```

What Is DHCP Snooping?

```

DHCP Snooping allows a switch to inspect DHCP messages and apply rules based on whether a port is trusted or untrusted. 

                 Switch
           +---------------+
           | DHCP Snooping  |
           +-------+-------+
                   |
          +--------+--------+
          |                 |
      Trusted            Untrusted
         Port                Ports
          |                   |
    DHCP Server            Clients

The basic idea is: 

Trusted Port
    ↓
Authorized DHCP server path


Untrusted Port
    ↓
Endpoint/client path
```

Trusted vs Untrusted Ports

```
Port Type Typical Purpose
Trusted Legitimate DHCP server or an upstream path where DHCP server responses are expected
Untrusted Client-facing access ports where unauthorized DHCP server messages should not be accepted

The correct trust boundary depends on the network design. A port should only be trusted when DHCP server traffic is legitimately expected through that interface.

```

How DHCP Snooping Stops Rogue DHCP Servers

``` 
          Legitimate DHCP Server
                   |
              Trusted Port
                   |
                   v
             +-----------+
             |  Switch   |
             | DHCP      |
             | Snooping  |
             +-----------+
                   |
            Untrusted Ports
              /         \
            PC1         PC2


    Rogue DHCP Server
            |
      Untrusted Port
            |
            X
    DHCP server traffic
    can be blocked

DHCP Snooping allows the switch to distinguish trusted DHCP server traffic from DHCP server messages arriving through untrusted ports.

```

DHCP Snooping Binding Table

```

One of the important features of DHCP Snooping is the DHCP Snooping Binding Database.

The switch can learn information about DHCP clients, including values such as:

  • MAC address
  • Assigned IP address
  • VLAN
  • Interface
  • Lease information
```

+---------------------------------------------------------+
| DHCP Snooping Binding Table                             |
+----------------+----------------+------+---------------+
| MAC Address    | IP Address     | VLAN | Interface     |
+----------------+----------------+------+---------------+
| 0011.2233.4455 | 192.168.10.10  | 10   | Gi0/2         |
| 0066.7788.9900 | 192.168.10.11  | 10   | Gi0/3         |
+----------------+----------------+------+---------------+
```

This information can also support other switch security features, such as Dynamic ARP Inspection and IP Source Guard.

```

DHCP Snooping Process

```
  1. A client sends a DHCP request.
  2. The switch inspects the DHCP message.
  3. The request is forwarded according to DHCP Snooping rules.
  4. The legitimate DHCP server sends a response through the trusted path.
  5. The switch learns the client binding information when applicable.
  6. Unauthorized DHCP server responses arriving through untrusted ports can be blocked.
```

DHCP Snooping Topology

``` 
             DHCP Server
                 |
             Trusted Port
                 |
          +------+------+
          |   Switch    |
          | DHCP        |
          | Snooping    |
          +------+------+
             /    |    \
            /     |     \
         PC1     PC2     PC3
      Untrusted Untrusted Untrusted


      Rogue DHCP Server
             |
       Untrusted Port
             |
             X
    Unauthorized DHCP
    server traffic
```

Enabling DHCP Snooping on Cisco

```

First enable DHCP Snooping globally: 

```

Switch(config)# ip dhcp snooping
```

Then enable it for the required VLAN: 

```

Switch(config)# ip dhcp snooping vlan 10
```

Configure the legitimate DHCP server-facing interface as trusted: 

```

Switch(config)# interface gigabitEthernet0/1
Switch(config-if)# ip dhcp snooping trust
```

Client-facing interfaces should normally remain untrusted by default.

```

DHCP Snooping Rate Limiting

```

DHCP Snooping can also be used with rate limiting on untrusted interfaces to limit the rate of DHCP messages. 

```

Switch(config)# interface gigabitEthernet0/2
Switch(config-if)# ip dhcp snooping limit rate 10
```

The appropriate limit depends on the network design and expected DHCP traffic.

```

DHCP Snooping Option 82

```

DHCP Snooping can interact with DHCP Option 82, which can carry relay-agent information such as information about where a DHCP request entered the network.

Option 82 behavior depends on the switch platform, configuration, and DHCP server design, so it should be tested carefully before deployment.

```

How to Verify DHCP Snooping

```

Use: 

```

Switch# show ip dhcp snooping
```

To view learned bindings: 

```

Switch# show ip dhcp snooping binding
```

To inspect the configuration: 

```

Switch# show running-config | include dhcp snooping

DHCP Snooping and Dynamic ARP Inspection

```

DHCP Snooping is also an important foundation for other Layer 2 security mechanisms. 

    DHCP Snooping
          |
          v
   Binding Database
      /       \
     /         \
    v           v
```

Dynamic ARP    IP Source
Inspection       Guard
```

Dynamic ARP Inspection can use DHCP Snooping bindings to help validate ARP information, while IP Source Guard can use binding information to help restrict source IP/MAC combinations on protected interfaces.

```

DHCP Snooping vs DHCP

```
DHCP DHCP Snooping
Provides network configuration to clients Provides switch-level security controls around DHCP traffic
Runs between DHCP clients and servers Operates on network switches
Assigns IP addresses Helps control which DHCP server traffic is trusted
Provides lease information Can build a DHCP snooping binding database
```

Common DHCP Snooping Mistake

```

One common configuration mistake is trusting the wrong interface. 

   Legit DHCP Server
          |
          | Correct
          v
    [ Trusted Port ]


   Client Port
          |
          | Should normally
          | remain untrusted
          v
    [ Untrusted Port ]

If a legitimate DHCP server path is not trusted where required, legitimate DHCP responses may be blocked. Therefore, the trust boundary must match the actual topology.

```

Practical Packet Tracer Lab

```

Topology

              DHCP Server
                   |
                Gi0/1
                   |
            +------+------+
            |   Switch    |
            +------+------+
              |    |    |
            PC1   PC2   PC3
          Gi0/2 Gi0/3 Gi0/4

Tasks

  1. Create VLAN 10.
  2. Configure the DHCP server.
  3. Enable DHCP Snooping globally.
  4. Enable DHCP Snooping for VLAN 10.
  5. Trust the DHCP server-facing interface.
  6. Keep client-facing interfaces untrusted.
  7. Configure a DHCP client.
  8. Verify that the client receives a valid address.
  9. Check the DHCP Snooping binding table.
  10. Test an unauthorized DHCP server path in a controlled lab.

Basic Configuration

```

Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10

Switch(config)# interface gigabitEthernet0/1
Switch(config-if)# ip dhcp snooping trust
```

Verification

```

Switch# show ip dhcp snooping
Switch# show ip dhcp snooping binding

Quick Quiz

```

Question 1

What problem does DHCP Snooping help prevent?

Show Answer

It helps protect against unauthorized or rogue DHCP server responses reaching clients.

Question 2

What is a trusted DHCP Snooping port?

Show Answer

A port through which legitimate DHCP server traffic is expected and therefore trusted by the DHCP Snooping configuration.

Question 3

What is normally the status of an endpoint-facing port?

Show Answer

Untrusted.

Question 4

What is stored in a DHCP Snooping binding database?

Show Answer

Information such as client MAC address, assigned IP address, VLAN, interface, and lease information.

Question 5

Which command displays DHCP Snooping bindings?

Show Answer

show ip dhcp snooping binding

```

Key Takeaways

```
  • DHCP automatically provides network configuration to clients.
  • A rogue DHCP server can provide unauthorized network configuration.
  • DHCP Snooping is a switch security feature.
  • Trusted ports are used where legitimate DHCP server traffic is expected.
  • Client-facing ports are normally left untrusted.
  • DHCP Snooping can build a binding database.
  • Bindings can contain MAC, IP, VLAN, interface, and lease information.
  • DHCP Snooping can support other security features such as Dynamic ARP Inspection and IP Source Guard.
  • show ip dhcp snooping and show ip dhcp snooping binding are useful verification commands.
```
```

Want to Learn DHCP Snooping and Network Security? Visit ATN Campus

Want to learn DHCP, DHCP Snooping, VLAN security, Dynamic ARP Inspection, IP Source Guard, switching, routing, and network security through practical training?

Visit ATN Campus and learn networking through practical Cisco labs, real-world security scenarios, and hands-on training.

Build Practical Networking & Security Skills

  • CCNA – Cisco Certified Network Associate
  • CCNP – Cisco Certified Network Professional
  • DHCP & DHCP Snooping
  • VLAN & Switching Security
  • Dynamic ARP Inspection
  • IP Source Guard
  • Network Security
  • CEH – Certified Ethical Hacker
  • Cisco Packet Tracer Labs
  • Python for Network Automation

Whether you are a beginner, preparing for CCNA or CCNP, or developing practical cybersecurity and networking skills, ATN Campus can help you move from theory to hands-on experience.

???? Want to learn networking? Visit ATN Campus.

???? Learn Networking. ???? Secure Your Network. ???? Practice with Real Labs. ???? Prepare for Certifications. ???? Build Your IT Career with ATN Campus.
```

Share this article:

Facebook Twitter WhatsApp LinkedIn
Related Articles
Networking
Network Engineer Career Roadmap: From Student to Network Professional
Networking
What Is a Reverse Proxy? Nginx, HTTPS and Web Applications
Networking
What Is a Load Balancer? How Websites Handle Millions of Users
Back to All Articles
Recent Posts
Categories
Networking 105 Cyber Security 9 Career 6 Python 4 Cloud 4
Document ATN CAMPUS