Network Skills / CCNA 200-301 Tutorials / DHCP Snooping Tutorial

DHCP Snooping Tutorial

2 min read

DHCP Snooping is a Layer 2 security feature that can be enabled on a switch to monitor DHCP traffic passing through it. Its main job is to block DHCP OFFER and DHCP ACK packets on any port that is not explicitly trusted — since only a legitimate DHCP server should ever send these message types, this effectively stops a rogue device from pretending to be a DHCP server on the network.

Topology showing DHCP snooping blocking rogue DHCP responses
DHCP snooping blocks DHCP OFFER/ACK messages arriving on untrusted ports.

Setting Up DHCP Snooping

Enabling DHCP snooping comes down to two steps:

  1. Turn the feature on for the switch as a whole.
  2. Mark the port(s) connected to the legitimate DHCP server as trusted. Every other port is treated as untrusted by default.
// members only

The rest of this article is for members

The full walkthrough, configuration examples and verification steps are available exclusively to paid members.

View membership plans Log in