Introducing DHCP Snooping
DHCP snooping is a control plane feature that closely monitors and restricts DHCP operations on a VLAN. Control plane means the feature runs on the central management processor where it is possible to perform deep-packet inspection operations. DHCP snooping introduces the concept of trusted and untrusted ports inside a given VLAN.
NOTE For a quick review of the steps involved in a typical DHCP operation, review the beginning of this chapter: DORA (Discover/Offer/Request/Ack).
Hosts have no reason to generate DHCPOFFER or DHCPACK messages; they are only supposed to issue DHCPDISCOVER and DHCPREQUEST messages. This is where DHCP snooping comes into play: An untrusted port does not let "bad" packets enter the switch. Bad packets mean DHCPOFFER and DHCPACK if the port in question is connected to a host. Figure 5-6 demonstrates that the switch blocks DHCPOFFER (and DHCPACK and DHCPNAK) messages from the attacker port because they come from an untrusted port.
Figure 5-6 DHCP Snooping: Trusted and Untrusted Ports
OK DHCP Responses: Offer, Ack, Nak
DHCP Server
Figure 5-6 DHCP Snooping: Trusted and Untrusted Ports
OK DHCP Responses: Offer, Ack, Nak
DHCP Server
Attacker
BAD DHCP
Responses: DHCP Snooping Enabled Offer, Ack, Nak
Attacker
BAD DHCP
Responses: DHCP Snooping Enabled Offer, Ack, Nak
Think of DHCP snooping as a specialized firewall placed between trusted and untrusted ports. It works by collecting dynamic IP-to-MAC bindings for each secured switch port. By peeking into DHCP packets, the switch learns the IP address that a DHCP server has assigned to a given client (identified by a unique MAC address) on a specific LAN port in a given VLAN. The DHCP binding entry consists of the quadruple <IP address, MAC address, lease time, interface>. After an entry is created for a specific port, incoming DHCP messages are compared against the binding information. If the information contained in the packet does not match the binding, an error condition is flagged, and the packet is discarded. DHCP snooping provides the following security features:
• Rate-limiting DHCP messages on a port
• DHCP message validation
• Option 82 insertion/removal. Provides the DHCP server with information about which switch and which port on that switch a DHCP request is coming from
• Prevention of DoS attack through DHCP
The following sections explain these features.
Continue reading here: DHCP Message Validation
Was this article helpful?