How DHCP Snooping works Explained

DHCP snooping is a switch-only feature. It works only on switches. It operates on a per-VLAN basis. You can enable and configure it on a specific VLAN or across all VLANs. If you enable it in a particular VLAN, it will work only in that VLAN. For instance, if you configure it on VLAN-2, it will function only on the ports associated with VLAN-2. By default, it is disabled on all VLANs.

How DHCP snooping works

DHCP snooping functions similarly to a firewall. It inspects all incoming messages on each port. It allows all non-DHCP messages. It evaluates all DHCP-related messages and either allows or denies them based on the configured policies.

The man-in-the-middle attack on the DHCP server

In this type of attack, an attacker configures a fake DHCP server on a device and connects it to the local network. When a DHCP client broadcasts a request for IP configuration, the attacker's device intercepts the message and provides a modified IP configuration to the client.

The modified IP configuration typically retains all original addresses except for the gateway IP address, which is replaced with the attacker's device address. As a result, all packets intended for the default gateway are first sent to the attacker's device, which then forwards them to the legitimate gateway.

Because all client packets are routed through the attacker's device before reaching the default gateway, the attacker can intercept, copy, or extract sensitive information from these packets. This scenario constitutes a man-in-the-middle attack on the DHCP server. The following image shows a network in which the client receives an IP configuration from the DHCP server and uses this configuration to connect to a remote network.

The following image shows the same network. But this time, the client receives an IP configuration from the attacker's DHCP server.

The following image illustrates the data flow between the client and the default gateway following a man-in-the-middle attack.

How does DHCP snooping protect the network from the man-in-the-middle attack?

DHCP uses four message types: Discover, Offer, Request, and ACK. From these messages, DHCP clients use Discover and Request messages while DHCP servers use Offer and ACK messages. Because DHCP clients do not use Offer and ACK messages, DHCP snooping can be configured to filter these messages on ports connected to clients. This approach mitigates the risk of man-in-the-middle attacks targeting DHCP servers.

In the above example, the DHCP server is connected to port Fa0/11. Configure DHCP snooping to allow Offer and ACK messages to be sent exclusively on port Fa0/11. After DHCP snooping is configured, the switch accepts Offer and ACK messages only on ports designated as trusted. Any Offer or ACK messages received on untrusted ports are immediately discarded.

The following image shows how DHCP snooping protects this network against a man-in-the-middle attack.

In this scenario, when the attacker attempts to lease an IP configuration to the client, the switch blocks the attacker's offer. As a result, the client receives IP configuration only from the authenticated DHCP server.

In DHCP snooping configuration, a trusted port can accept all four message types, whereas an untrusted port can accept only the Discover and Request message types. On untrusted ports, DHCP snooping blocks the Offer and ACK messages needed by the DHCP server to assign IP addresses to clients. Without the ability to send these messages, a DHCP server cannot lease IP addresses to clients. Consequently, a DHCP server connected to an untrusted port cannot lease IP addresses to clients, as DHCP snooping prevents the necessary messages from being transmitted.

The following image shows how DHCP snooping blocks and allows DHCP messages.

DHCP binding table

The DHCP binding table provides an additional layer of security beyond DHCP snooping. This table maintains a record of all offered or leased IP addresses, which is then used to block denial-of-service (DoS) attacks.

When a client broadcasts a DHCP Discovery message, it includes its MAC address. The DHCP server uses the client's MAC address to assign an IP address. Since a client uses a local broadcast address to send the DHCP Discovery message, an attacker's device connected to the local network also receives it. From the broadcast message, it learns the client's MAC address and uses it to send fake DHCP requests.

The following image shows a network with DHCP snooping enabled. In this scenario, the client sends a DHCP Discovery broadcast message, and both legitimate and rogue DHCP servers respond. DHCP snooping filters and blocks the rogue server's offer, permitting only the legitimate server's offer to reach the client. Consequently, the client receives IP configuration solely from the genuine DHCP server.

Although the attacker's device cannot provide an IP address to the client, it can still obtain the client's MAC address. The attacker then uses this MAC address to generate multiple fake DHCP requests. Because DHCP snooping does not block Discovery or Request messages, these messages are delivered to the legitimate DHCP server, which responds with an IP configuration for each request. The following image illustrates this process.

Eventually, the attacker leases all available IP addresses from the DHCP server, leaving none for legitimate clients. Once all addresses are allocated, the DHCP server cannot provide IP addresses to clients configured for dynamic assignment, resulting in loss of network connectivity for those clients. This scenario constitutes a DoS attack on the DHCP server. To mitigate this threat, DHCP snooping records each successful assignment in the DHCP binding table. When a Discovery or Request message is received on an untrusted port, the switch checks the MAC address against the binding table and discards the message if a matching entry is found.

The following image shows how it works.

Conclusion

DHCP snooping is a critical security feature for network switches, protecting against both man-in-the-middle and denial-of-service attacks. By differentiating between trusted and untrusted ports and maintaining a DHCP binding table, DHCP snooping ensures that only authorized DHCP servers can assign IP addresses to clients, thereby safeguarding network integrity and availability.