Security glossary

What is DHCP snooping?

DHCP snooping is a Layer 2 security control that filters DHCP messages on a switch to block unauthorized DHCP servers from handing out addresses. It classifies ports as trusted or untrusted and builds a binding table that maps client MAC addresses to leased IP addresses, VLANs and ports.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

DHCP snooping is a Layer 2 security control that filters DHCP messages on network switches to block unauthorized DHCP servers from distributing incorrect gateway or DNS settings to clients. The feature classifies switch ports as trusted or untrusted, inspects DHCP traffic, and maintains a binding table that maps client MAC addresses to assigned IP addresses, lease times, VLANs, and ports. This binding table enables related Layer 2 protections such as dynamic ARP inspection and IP source guard, while common misconfigurations—including leaving uplinks untrusted, losing the binding table after reload, and inconsistent relay option handling—can cause legitimate clients to fail to obtain addresses.

  • DHCP snooping filters server messages arriving on untrusted ports and can verify that client hardware addresses in DHCP requests match the source MAC address of the frame to limit exhaustion attacks using forged addresses.
  • The binding table generated by DHCP snooping records client MAC addresses, assigned IP addresses, lease times, VLANs, and ports, which other Layer 2 protections like dynamic ARP inspection and IP source guard depend on to drop traffic that does not match valid leases.
  • Static-addressed hosts and DHCP relay deployments require manual configuration—static devices need binding entries added manually, and relay paths must handle DHCP option 82 consistently across all switches to prevent legitimate client lease failures.

DHCP snooping at a glance

AttributeValue
CategorySecurity control
Protocol and portInspects DHCP messages, which use UDP ports 67 and 68
OSI layerLayer 2, with inspection of Layer 3 and 4 DHCP fields
Primary useBlocking rogue DHCP servers and building a table of valid lease bindings
Related termsDHCP, Rogue DHCP server, Dynamic ARP inspection, IP source guard, DHCP relay, DHCP option 82

How DHCP snooping works

A switch with DHCP snooping enabled inspects DHCP packets in the VLANs where the feature is turned on. An administrator marks each port as trusted or untrusted, and the switch applies different rules to each.

  1. Designate trusted ports: The administrator marks ports that lead toward legitimate DHCP servers or relay agents as trusted. All other ports, typically those facing client devices, remain untrusted.
  2. Filter server messages: The switch drops DHCP server messages, such as offers and acknowledgments, that arrive on an untrusted port. This stops a rogue server on an access port from answering clients.
  3. Inspect client messages: On untrusted ports the switch can check that the client hardware address in a DHCP request matches the source MAC address of the frame. This limits some exhaustion attacks that use forged addresses.
  4. Build the binding table: When a client receives a valid lease, the switch records the client MAC address, assigned IP address, lease time, VLAN and port in a binding table.
  5. Apply the bindings: The binding table is used by related features, such as dynamic ARP inspection and IP source guard, to drop traffic that does not match a known lease.

Snooping does not authenticate clients or the legitimate server. Behavior such as rate limiting, option 82 insertion and binding table persistence varies by switch vendor and configuration.

Why DHCP snooping matters in enterprise networks

A rogue DHCP server can be a misconfigured router, a home gateway plugged into an office jack, or a deliberate attack. Clients that accept its offers may receive a wrong gateway or DNS server, which causes outages or lets an attacker redirect and intercept traffic. Because DHCP is broadcast-based and clients accept the first suitable offer, the network cannot rely on clients to pick the right server.

DHCP snooping addresses this at the access layer, where the problem starts. It also produces the binding table that other Layer 2 protections depend on. Dynamic ARP inspection and IP source guard use these records to block ARP spoofing and forged source addresses, so a single correctly maintained table supports several controls.

Poor configuration causes its own failures. If the uplink toward the real server or relay is left untrusted, legitimate offers are dropped and clients cannot get addresses. If the binding table is lost after a switch reload and not restored, protections that depend on it can block valid hosts. Hosts with static addresses need manual binding entries, and relay deployments need consistent option 82 handling across switches.

DHCP snooping vs Rogue DNS server

DHCP snooping is a switch control that blocks unauthorized DHCP servers, while a rogue DNS server is an unauthorized resolver that answers name queries, often installed by an attacker or pushed to clients through a rogue DHCP server. What is Rogue DNS Server?

AttributeDHCP snoopingRogue DNS server
TypePreventive control on a switchUnauthorized server or threat
Protocol involvedDHCPDNS
Where it actsAccess layer ports and VLANsAnywhere clients can reach it
RelationshipCan stop clients from receiving a rogue DNS address in a DHCP offerCan be delivered to clients through a rogue DHCP server

DHCP snooping vs ACL (Access Control List)

DHCP snooping understands DHCP message types and tracks leases in a binding table, while an ACL matches packets on static header fields such as addresses and ports. What is ACL?

AttributeDHCP snoopingACL (Access Control List)
Awareness of DHCPInspects DHCP messages and tracks leasesMatches fixed header fields only
StateBuilds a binding tableStateless in its basic form
Configuration unitTrusted and untrusted ports per VLANOrdered permit and deny rules

Common DHCP snooping issues

If the port toward the DHCP server or relay is not marked trusted, the switch drops legitimate offers and acknowledgments. Clients then fail to get addresses, often only in VLANs where snooping was newly enabled.

If the binding table is held only in memory, a switch reload clears it and features that depend on it can block valid clients until they renew. Storing the table in persistent storage, where the platform supports it, reduces this.

Some switches insert relay information into client requests by default. When the upstream relay or server rejects packets that carry it without a matching relay address, clients fail to lease. Align the option setting across the switch and relay path.

Devices with static addresses never appear in the binding table. When ARP inspection or source guard relies on that table, their traffic is dropped unless static entries are added.

A low DHCP packet rate limit on an untrusted port can put it into an error-disabled state during legitimate bursts, such as many clients booting at once. The port stays down until it is recovered manually or by a timer.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

DHCP snooping FAQ

Related terms

Article

DHCP (Dynamic Host Configuration Protocol)

DHCP (Dynamic Host Configuration Protocol) is the standard mechanism to dynamically assign IP addresses within a network.

Learn more
Article

DHCP Relay Agent

A DHCP relay agent forwards DHCP messages between clients and servers on different network subnets, enabling centralized DHCP services.

Learn more
Article

Rogue DNS Server

A rogue DNS server is a DNS server that translates domain names of desirable websites into IP addresses of sites with unintended content.

Learn more
Article

DHCP Lease

A DHCP lease is the period during which a DHCP server assigns an IP address to a client device, allowing it to use that address before renewal or expiration.

Learn more
Article

DORA process

The DORA process is the four-step sequence of Discover, Offer, Request, and Acknowledge messages exchanged between DHCP client and server to assign an IP address.

Learn more
Article

Hypertext Transfer Protocol (HTTP)

Hypertext Transfer Protocol (HTTP) is an application-layer protocol used to transfer data between web browsers and servers, enabling World Wide Web communication.

Learn more
Article

ACL (Access Control List)

An ACL (Access Control List) limits which entities are allowed to perform certain functions against a DNS server, such as sending queries or performing dynamic updates.

Learn more
Browse the full glossary