UK How DHCP snooping works
DHCP snooping is a security feature of managed Ethernet switches that controls which ports may hand out IP addresses. Most networks give devices their addresses with DHCP, the Dynamic Host Configuration Protocol: a device broadcasts a request, and any DHCP server that hears it can answer with an address, a subnet mask and a default gateway. The device takes the first answer it gets, which is the weakness snooping fixes.
With snooping enabled, every port is untrusted unless you say otherwise. On an untrusted port the switch accepts client messages such as DISCOVER and REQUEST, but drops server messages such as OFFER and ACK. You then mark as trusted only the uplinks that lead to the real DHCP server. A laptop, router or misconfigured device on an access port can no longer hand out addresses, because its offers never leave the port.
As genuine leases pass through, the switch also records each one in a binding table: the device’s MAC address, the IP address it was given, the VLAN, the switch port and the lease time. That table is what makes the related protections possible.
What DHCP snooping protects against
The feature exists because a single wrong DHCP answer can take devices off the network or route their traffic through an attacker.
-
//
Accidental rogue servers. Someone plugs a small office router or a laptop with connection sharing into a spare socket, and devices start receiving addresses and gateways that go nowhere.
-
//
DHCP spoofing. An attacker answers requests with their own address as the default gateway, so traffic passes through them on its way out.
-
//
DHCP starvation. A device requests addresses with thousands of fake MAC addresses until the pool runs dry. Snooping switches can rate-limit DHCP messages on untrusted ports to slow this down.
-
//
Forged release messages. The switch can check that a release or decline arrives on the same port as the original lease before passing it on.
DHCP snooping and the related switch protections
DHCP snooping is usually the first of several features that work from the same binding table. Together they stop a device using an address or identity it was not given.
| Feature | What it checks | What it stops |
|---|---|---|
| DHCP snooping | DHCP server messages only from trusted ports | Rogue DHCP servers, spoofed gateways |
| IP source guard | Source IP (and optionally MAC) against the binding table | Devices using an address they were not given |
| Dynamic ARP inspection | ARP replies against the binding table | ARP spoofing and man-in-the-middle attacks |
| DHCP Option 82 | Adds the switch and port to each request | Wrong address after a device is swapped |
| Port security | Number and identity of MAC addresses per port | Extra or unknown devices on a port |
IP source guard and ARP inspection only allow traffic that matches the table, so devices with fixed IP addresses need static bindings or they will be blocked. On plant networks, where many PLCs and drives use static addresses, that step is easy to miss.
What is DHCP Option 82?
DHCP Option 82, the relay agent information option defined in IETF RFC 3046, lets the switch add its own details to each DHCP request before passing it on. The two common parts are the circuit ID, which identifies the switch port and VLAN, and the remote ID, which identifies the switch. The DHCP server can then choose an address by location instead of by MAC address.
That matters on machine networks. If address 10.0.5.21 is reserved for the device on port 3 of the cell switch, a replacement sensor or drive gets the same address the moment it is plugged in, without anyone editing a reservation for its new MAC address. Some of our switches list DHCP Option 66 and 67 alongside 82; those options tell a device where to find its boot or configuration file, which helps with automatic provisioning.
Option 82 is commonly inserted by switches with DHCP snooping enabled, so if the server does not expect it, check whether the switch should insert it or not.
DHCP snooping on industrial networks
Industrial networks are often flat and lightly guarded inside the cabinet, which makes a stray DHCP server a real risk: a contractor’s laptop or a test router can knock a line’s HMIs and cameras off their addresses. Running DHCP snooping on access switches, with trusted uplinks only, is a low-effort fix. Keep it per VLAN, so each cell has its own trusted path, as our explainer on what a VLAN is describes.
In our range, DHCP snooping is listed on selected Layer 2+ and Layer 3 models among our managed industrial switches and our rack mount industrial switches, often with IP source guard and ARP inspection. DHCP Option 82 is far more widely listed, including on many of our industrial PoE switches, so check the datasheet for the exact feature you need.
Quick answers on DHCP snooping
DHCP snooping: common questions
What is the difference between DHCP snooping and DHCP spoofing?
One is the defence, the other the attack. Spoofing is answering DHCP requests with false information. Snooping is the switch feature that blocks those answers from untrusted ports.
Which ports should be trusted in DHCP snooping?
Only the paths to your real DHCP server. Usually the uplinks towards the core or the server, and the server’s own port. Every access port to an end device stays untrusted.
Can DHCP snooping cause problems?
Yes, if misconfigured. Forgetting to trust an uplink stops every device getting an address, and Option 82 insertion can confuse a server that does not expect it.
Does DHCP snooping affect devices with static IP addresses?
Not on its own. Snooping only inspects DHCP messages. IP source guard and ARP inspection can block static devices unless you add static bindings.
Is DHCP snooping enabled by default?
Usually not. Most managed switches ship with it off, because it needs trusted ports set for each network.
We supply managed industrial switches as part of a complete system, and as standard we configure VLANs, trusted ports and DHCP options to your addressing plan before it ships.