DHCP Snooping Operations
If a DHCP message is received on a trusted port, forward it as normal without inspection.
If a DHCP message is received on an untrusted port, inspect it and act as follows:
If it is a DHCP Server message, discard it.
If it is a DHCP Client message, perform the following checks:
DISCOVER/REQUEST messages: Check if the frame's source MAC address and the DHCP message's CHADDR fields match. Match = forward, mismatch = discard.
RELEASE/DECLINE messages: Check if the packet's source IP address and the receiving interface match the entry in the DHCP Snooping Binding Table. Match = forward, mismatch = discard.
When a client successfully leases an IP address from a server, create a new entry in the DHCP Snooping Binding Table.
Configurations
RELEASE/DECLINE messages will be checked to make sure their IP address/interface ID match the entry in the DHCP snooping table.
Last updated