DHCP Snooping
DHCP Snooping is a security feature implemented on network switches to mitigate rogue DHCP server attacks and ensure the integrity of DHCP (Dynamic Host Configuration Protocol) traffic. It works by filtering and monitoring DHCP messages exchanged between clients and servers. The switch acts as a trusted intermediary, validating DHCP messages to prevent unauthorized or malicious DHCP servers from assigning incorrect IP addresses or other network parameters to clients.
Purpose
The primary purposes of DHCP Snooping are:
- Prevent Rogue DHCP Servers: Block unauthorized DHCP servers from distributing incorrect IP addresses or network configurations.
- Ensure Network Integrity: Validate DHCP messages to ensure clients receive legitimate IP addresses and network settings.
- Enhance Security: Protect against attacks such as IP address spoofing, DHCP starvation, and man-in-the-middle attacks.
- Improve Network Management: Provide visibility into DHCP traffic and create a trusted DHCP environment.
Implementation Mechanism
DHCP Snooping operates through the following steps:
- Port Classification:
- Trusted Ports: Ports connected to legitimate DHCP servers or authorized network devices. DHCP messages from these ports are allowed.
- Untrusted Ports: Ports connected to clients or potentially untrusted devices. DHCP messages from these ports are inspected and filtered.
- DHCP Message Inspection:
- The switch monitors DHCP traffic on untrusted ports.
- It verifies the legitimacy of DHCP messages, such as DHCP DISCOVER, DHCP OFFER, DHCP REQUEST, and DHCP ACK.
- DHCP Binding Table:
- The switch maintains a DHCP Snooping Binding Table, which records the mappings between client MAC addresses, assigned IP addresses, VLANs, and the associated switch ports.
- This table is used to validate subsequent DHCP messages and ensure consistency.
- Filtering and Blocking:
- If a DHCP message from an untrusted port is deemed invalid (e.g., a rogue DHCP OFFER), the switch blocks the message and logs the event.
- Only legitimate DHCP messages from trusted ports are forwarded to clients.
- Rate Limiting (Optional):
- To prevent DHCP starvation attacks, the switch can limit the rate of DHCP messages from untrusted ports.
Example Scenario
Consider a network with:
- A legitimate DHCP server connected to a trusted port.
- Multiple clients connected to untrusted ports.
- A rogue DHCP server attempting to assign incorrect IP addresses.
Steps:
- The switch allows DHCP messages from the legitimate DHCP server (trusted port).
- The switch inspects DHCP messages from clients (untrusted ports) and verifies their legitimacy.
- If a rogue DHCP server sends a DHCP OFFER, the switch blocks the message and logs the event.
- The switch updates the DHCP Snooping Binding Table with valid client IP assignments.
Key Benefits
- Security: Protects against rogue DHCP servers and DHCP-based attacks.
- Reliability: Ensures clients receive correct IP addresses and network configurations.
- Visibility: Provides insights into DHCP traffic and client assignments.
