DHCP Snooping: Layer 2 Defense Against Rogue DHCP and Network Attacks

In modern networks, DHCP is essential for automatically assigning IP addresses. However, this convenience introduces security risks such as rogue DHCP servers and DHCP starvation attacks.

To mitigate these threats, switches use a Layer 2 security feature called DHCP Snooping.

DHCP Snooping acts as a control mechanism that filters DHCP traffic and ensures only legitimate DHCP servers can operate on the network

What is DHCP Snooping?

DHCP Snooping is a switch security feature that:

• Filters DHCP messages received on untrusted ports
• Allows only trusted devices to send DHCP server messages
• Does not affect non DHCP traffic

By default:

• All ports are untrusted
• Uplink ports (toward DHCP server) are configured as trusted
• Access ports (end devices) remain untrusted

How DHCP Snooping Works

DHCP Snooping differentiates between:

• Client messages → DISCOVER, REQUEST, RELEASE (Used to tell the server that the client no longer needs its IP address), DECLINE (Used to decline the IP address offered by a DHCP server)
• Server messages → OFFER, ACK, NAK (Opposite of ACK, used to decline a client’s Request)

NOTE: Untrusted ports cannot send OFFER and ACK but can receive

Behavior Based on Port Type

Trusted Ports

• Forward DHCP messages without inspection

Untrusted Ports

• Drop DHCP server messages (OFFER, ACK, NAK)
• Inspect client messages before forwarding

Packet Validation on Untrusted Ports

When DHCP messages arrive on untrusted ports, the switch performs checks:

For DISCOVER / REQUEST

• Compares: Source MAC address and CHADDR field (client MAC in DHCP message)
• Match → Forward
• Mismatch → Drop

For RELEASE / DECLINE

Fig 1: Binding Table Entry

• Verifies: Source IP address and Incoming interface
• Must match the binding table entry
• If not → Dropped, if matched → Forward

DHCP Snooping Binding

When a client successfully receives an IP address, the switch creates an entry in the binding table.

It stores:

• MAC Address
• IP Address
• VLAN
• Interface
• Lease time

This table is critical for Dynamic ARP Inspection (DAI) and IP Source Guard

Rate Limiting (Protection Against Flooding)

DHCP Snooping allows limiting DHCP packets per interface.

• If rate exceeds threshold:
• Interface goes into err-disabled state
• Can be recovered manually or automatically

This helps prevent DHCP exhaustion attacks

Attacks Prevented by DHCP Snooping

1. DHCP Starvation (Exhaustion) Attack

In a DHCP starvation attack, an attacker floods the DHCP server with multiple DISCOVER messages using spoofed MAC addresses. Each request consumes an IP address, eventually exhausting the DHCP pool.

Fig 2: DOS result of DHCP Starvation

Result: Legitimate clients are unable to obtain IP addresses, leading to a Denial of Service (DoS).

How DHCP Snooping Protects Against It:

• Applies rate limiting on untrusted ports to restrict DHCP requests
• Detects abnormal traffic patterns and can err-disable the interface
• Prevents a single device from overwhelming the DHCP server

2. DHCP Poisoning (Rogue DHCP Server / MITM)

In a DHCP poisoning attack, an attacker sets up a rogue DHCP server and responds to client requests faster than the legitimate server. The attacker assigns:

• Incorrect IP configuration
• Their own device as the default gateway

Fig 3: Rouge DHCP server offering IP

Result: Client traffic is redirected through the attacker, enabling a Man in the Middle (MITM) attack where data can be monitored or modified.

How DHCP Snooping Protects Against It:

• Marks ports as trusted or untrusted
• Blocks DHCP server messages (OFFER, ACK) from untrusted ports
• Ensures only legitimate DHCP servers can assign IP addresses

DHCP Option 82 (Relay Information Option)

DHCP Option 82 (Relay Agent Information Option) adds client location details such as the switch, port, or VLAN to DHCP messages. It can be inserted by a relay agent or by a switch when DHCP snooping is enabled. However, it must originate from a trusted device, if a packet containing Option 82 is received on an untrusted port, it is treated as suspicious and will be dropped to prevent spoofing or inconsistent relay information.