🔍

DHCP Snooping & Dynamic ARP Inspection

Medium

Free preview · 2 of 5 steps

The rogue DHCP threat

A DHCP server on your network is a powerful position: it controls every client's default gateway, DNS server, and IP address. An attacker who plugs in a rogue DHCP server can silently route all traffic through themselves — a perfect man-in-the-middle position.

DHCP snooping makes access switches enforce which ports are allowed to send DHCP server responses, building a trusted table of IP-to-MAC-to-port mappings that other defenses use.

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step