DHCP Snooping and Dynamic ARP Inspection (DAI)
As we discussed in Chapter 4.3 Dynamic Host Configuration Protocol (DHCP), DHCP dynamically assigns IP addresses to PCs. PCs use DHCP to obtain an IP address so they can participate in a TCP/IP-based network (for example, the Internet).
However, as we discussed in Chapter 8.1 Fundamental network security concepts, DHCP spoofing is a form of “man-in-the-middle” attack.
In a typical DHCP spoofing scenario:
- A rogue DHCP server is physically connected to your LAN.
- It impersonates a legitimate DHCP server by sending unsolicited DHCP_OFFER messages.
- Clients may accept the attacker’s DHCP information as legitimate.
- The attacker can provide settings (like the default gateway or DNS server) that force traffic to flow through the attacker.
A related DHCP-based attack uses malicious DHCP_REQUEST packets with many randomized, spoofed MAC addresses to exhaust the legitimate DHCP server’s address pool. When the pool is exhausted, real clients can’t obtain IP addresses.
Image
Image Title - Example of DHCP Spoofing
The cure for DHCP spoofing: DHCP snooping
DHCP Snooping is a Layer 2 security feature that acts like a “firewall” for DHCP messages, helping prevent DHCP spoofing. DHCP Snooping classifies switch ports as either trusted or untrusted.
- Trusted ports are typically connected to legitimate DHCP servers or other trusted network devices. They’re allowed to forward all DHCP messages.
- Untrusted ports are usually connected to end-user devices. These ports are subject to strict filtering rules.
Image
Image Text - Diagram displaying DHCP Snooping concepts
The core logic of DHCP Snooping is to examine DHCP messages and enforce rules based on the standard DHCP message flow (DISCOVER, OFFER, REQUEST, ACK - DORA):
- Server message filtering: On untrusted ports, DHCP Snooping discards any incoming DHCP server messages (like OFFERs or ACKs). This prevents rogue DHCP servers from operating on client-facing ports.
- Client message validation: For client-originated messages (DISCOVER, REQUEST, RELEASE, DECLINE):
- DISCOVER and REQUEST: These messages are checked for MAC address consistency. The source MAC address in the Ethernet frame must match the client hardware address (chaddr) within the DHCP message. This helps prevent a client from spoofing other devices’ MAC addresses to request multiple IP addresses.
- RELEASE and DECLINE: These messages are validated against the DHCP Snooping binding table. This table is dynamically built by DHCP Snooping and records legitimate IP-MAC-port-VLAN bindings learned from successful DHCP transactions. A RELEASE or DECLINE message is only permitted if the incoming port and associated IP address match an entry in this binding table. This prevents an attacker from prematurely releasing another client’s IP address.
DHCP snooping configuration and verification:
To configure DHCP Snooping:
-
Globally enable it (in Global Configuration mode)
-
Specify VLANs to snoop:
-
Configure trusted interfaces (for example, a port connected to a legitimate DHCP Server, a trunk port that leads to another switch that’s connected to a legitimate DHCP server, or a port connected to a router interface configured as a DHCP Relay Agent):
This prevents the switch from modifying DHCP messages in a way that might cause legitimate DHCP servers to drop them.
:::
Optional features include rate limiting:
to help prevent DoS attacks against the switch’s CPU by limiting the number of DHCP messages per second on a port. If a port exceeds its limit, it can be put into an err-disabled state, with errdisable recovery cause dhcp-rate-limit allowing for automatic recovery.
Verify DHCP Snooping status with:
And inspect the binding table with:
Dynamic ARP Inspection (DAI): Combating ARP spoofing
Address Resolution Protocol (ARP) is stateless and inherently insecure, which makes it vulnerable to spoofing attacks. An attacker can send forged ARP messages (for example, a gratuitous ARP) to associate the attacker’s MAC address with another device’s IP address. This can create a man-in-the-middle situation where traffic intended for the legitimate device is redirected through the attacker.
Dynamic ARP Inspection (DAI) is a Layer 2 security feature that helps prevent these ARP-based attacks.
How DAI works:
DAI inspects ARP packets on untrusted ports and validates them against trusted sources of IP-to-MAC bindings. Its primary source of truth is the DHCP Snooping binding table.
- If DHCP Snooping is enabled, DAI can use the legitimate IP-MAC-port associations learned during DHCP transactions.
- For devices with static IP addresses, you can configure ARP Access Control Lists (ACLs) as an alternative or supplementary source of trusted bindings.
Similar to DHCP Snooping, DAI uses trusted and untrusted ports:
- Trusted ports are typically connected to other switches or routers where ARP messages are expected to be legitimate.
- Untrusted ports are connected to end-user devices. All ARP messages arriving on untrusted ports are inspected.
When an ARP message arrives on an untrusted port, DAI looks up the sender IP address and sender MAC address in the DHCP Snooping binding table (or ARP ACLs). If the ARP message doesn’t match a valid entry, the switch discards it, preventing ARP spoofing.
DAI configuration and verification:
To configure DAI:
-
Enable it for specific VLANs:
-
Configure trusted interfaces:
DAI relies heavily on DHCP Snooping, so configure DHCP Snooping first if you need dynamic IP-MAC bindings.
Optional DAI features include:
-
Rate limiting
to protect the switch’s CPU from ARP DoS attacks.
You can verify DAI status and statistics with:
You can also check interface-specific DAI settings with: