LogoفارسیFA

Layer 2 Attack Mitigation: DHCP Snooping and Dynamic ARP Inspection

The MAC-learning and ARP mechanisms that make Ethernet networks function are also fundamentally trusting, creating openings for attacks that redirect or intercept traffic without ever touching a firewall. This article explains how a rogue DHCP server or ARP spoofing attack works, and covers how DHCP Snooping and Dynamic ARP Inspection work together to close these Layer 2 vulnerabilities.

DHCP SnoopingDynamic ARP InspectionRogue DHCP Server

~6 min read · Updated Sep 10, 2026

Why Layer 2 Trust Creates Security Gaps

The DHCP process and ARP resolution discussed earlier in this series were both designed decades ago under the assumption that every device on a local network segment could be trusted. Neither protocol includes any built-in authentication, meaning any device connected to a switch port can pretend to be a legitimate DHCP server or claim ownership of any IP address — a switch has no native way of knowing this is happening.

The Rogue DHCP Server Attack

Since DHCP relies entirely on client broadcasts, discussed earlier in this series, any device on the network can respond to a DHCP discovery message with its own offer, and the client accepts whichever offer it receives first.

Rogue DHCP attack scenario:
1. An attacker connects an unauthorized DHCP server
   to the network
2. A legitimate client broadcasts a DHCP discover
3. Both the real DHCP server AND the rogue server
   respond with offers
4. If the rogue server's offer arrives first, the
   client accepts it, receiving an attacker-controlled
   default gateway and DNS server
5. All of that client's traffic now flows through
   the attacker's device, enabling interception
   or manipulation of everything the client sends

This attack can occur completely by accident — an employee plugging in a personal wireless router with its own DHCP server enabled can unintentionally cause exactly this disruption, without any malicious intent at all.

DHCP Snooping: Establishing Trusted and Untrusted Ports

DHCP Snooping solves this by having the switch inspect DHCP traffic and classify each port as either Trusted (permitted to send DHCP server responses) or Untrusted (permitted only to send client requests, never server responses).

Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10,20

-- Trust only the port connecting to the
-- legitimate, known DHCP server
Switch(config)# interface gigabitethernet 1/0/24
Switch(config-if)# ip dhcp snooping trust

-- All other access ports remain untrusted by
-- default once DHCP snooping is enabled on the VLAN

With this configuration, if a DHCP server response (an Offer or Acknowledge message) is received on any untrusted port, the switch drops it immediately — the rogue server's responses never reach legitimate clients, regardless of how quickly they arrive.

The DHCP Snooping Binding Table

As a byproduct of monitoring DHCP traffic, the switch builds a DHCP Snooping Binding Table, recording which IP address was legitimately assigned to which MAC address on which port.

Switch# show ip dhcp snooping binding

MacAddress        IpAddress     Lease(sec)  Type          VLAN  Interface
00:50:56:aa:11:22 192.168.1.11  86400       dhcp-snooping 10    Gi1/0/5

This binding table becomes far more valuable than a simple attack-prevention log — it serves as the trusted reference data source for Dynamic ARP Inspection, described next.

The ARP Spoofing Attack

ARP (Address Resolution Protocol) resolves an IP address to a MAC address, and like DHCP, it operates entirely on trust — any device can send an ARP reply claiming to own any IP address, whether or not that claim is true.

ARP spoofing (also called ARP poisoning) attack:
1. An attacker sends a forged ARP reply, falsely
   claiming their own MAC address corresponds to
   the network's default gateway IP address
2. Nearby devices update their ARP tables to
   point the gateway IP at the attacker's MAC
3. Traffic intended for the real gateway is now
   sent directly to the attacker instead
4. The attacker can silently forward this traffic
   onward after inspecting or modifying it,
   a classic man-in-the-middle position

Dynamic ARP Inspection: Validating ARP Against Known-Good Data

Dynamic ARP Inspection (DAI) solves this by intercepting every ARP packet on untrusted ports and validating its claimed IP-to-MAC mapping against the DHCP snooping binding table built above — an ARP message that does not match a known, legitimate binding is dropped.

Switch(config)# ip arp inspection vlan 10,20

-- Trust the same ports trusted for DHCP snooping,
-- since a legitimate DHCP server's associated
-- infrastructure should also be trusted for ARP
Switch(config)# interface gigabitethernet 1/0/24
Switch(config-if)# ip arp inspection trust

Because DAI relies directly on the DHCP snooping binding table, DHCP snooping must be enabled first — attempting to configure DAI without an active, populated binding table would leave it with no legitimate data to validate ARP messages against, causing it to drop legitimate traffic.

Handling Devices with Statically Configured IP Addresses

Devices with static IP addresses, discussed earlier in this series, never generate a DHCP transaction, meaning they never appear in the DHCP snooping binding table, and DAI would incorrectly drop their legitimate ARP traffic by default.

Switch(config)# arp access-list STATIC-DEVICES
Switch(config-arp-nacl)# permit ip host 192.168.1.5 mac host 0050.56cc.5566

Switch(config)# ip arp inspection filter STATIC-DEVICES vlan 10

-- This manually permitted entry supplements the
-- dynamic DHCP snooping bindings for devices that
-- legitimately never go through DHCP

Verifying DAI Operation

Switch# show ip arp inspection interfaces

Interface     Trust State   Rate (pps)  Burst Interval
Gi1/0/5       Untrusted     15          1
Gi1/0/24      Trusted       none        N/A

Switch# show ip arp inspection statistics
Vlan   Forwarded   Dropped
10     1204        3

A non-zero Dropped count is worth investigating — it may reflect legitimate attack prevention working correctly, or it may indicate a legitimate statically configured device that still needs to be added to the ARP access list described above.

Why These Two Features Work Best Together

DHCP Snooping and Dynamic ARP Inspection are deliberately designed to be deployed together: DHCP Snooping's binding table provides the trusted reference data that makes DAI effective, and DAI in turn closes the ARP-based attack vector that DHCP Snooping alone does not address. Implemented together, they close two of the most common and consequential Layer 2 attack vectors in switched networks, protecting against threats that traditional Layer 3 ACLs and firewalls, discussed earlier in this series, cannot see or prevent, since these attacks never leave the local Layer 2 segment.

Written & researched by Dr. Shahin Siami

Related Articles

Quality of Service Fundamentals: Classifying and Prioritizing Network Traffic

Not all network traffic is equally sensitive to delay, and treating a voice call the same as a large file download during periods of congestion produces a poor experience for both. This article explains why QoS matters, covers the classification and marking of traffic using CoS and DSCP, walks through queuing strategies that determine which traffic is serviced first, and covers the essential configuration for applying QoS policies on a Cisco device.

Continue

Network Security Fundamentals: Device Hardening and Port Security

Before layering on advanced security features, every network device needs basic hardening to prevent unauthorized access and protect against common Layer 2 attacks. This article covers securing device management access with strong authentication, encrypting stored passwords, and configuring port security to restrict which devices can connect to a switch port.

Continue

IPv6 Fundamentals: Addressing for the Next Generation of the Internet

IPv4's limited address space made a successor protocol inevitable, and IPv6 provides an address space so vast that address exhaustion is no longer a practical concern. This article explains the structure of an IPv6 address, the shorthand notation rules used to write it compactly, the different IPv6 address types, and the essential commands for configuring and verifying IPv6 on a Cisco device.

Continue

OSPF Fundamentals: Link-State Routing Explained

OSPF is the most widely deployed interior routing protocol in enterprise networks, using a fundamentally different approach than simply exchanging routing tables between neighbors. This article explains what a link-state protocol actually is, how OSPF routers become neighbors and build a shared topology database, how the cost metric determines the best path, and the essential commands for configuring and verifying single-area OSPF.

Continue

Network Address Translation: Sharing Public IP Addresses

The limited supply of public IPv4 addresses made it impossible for every device worldwide to have its own globally unique address, and Network Address Translation solved this by letting many private devices share a small number of public addresses. This article explains the three main NAT types, walks through configuring static NAT, dynamic NAT, and PAT on a Cisco router, and covers the essential commands for verifying active translations.

Continue

Access Control Lists: Filtering Traffic on Cisco Routers

Access Control Lists let a router or switch selectively permit or deny traffic based on source, destination, and protocol information, forming the foundation of basic network security and traffic filtering. This article explains how ACLs process traffic sequentially, covers the difference between standard and extended ACLs, walks through wildcard mask calculation, and explains critical placement rules that determine whether an ACL works as intended.

Continue
Previous ArticleNext Article