DHCP snooping and Dynamic ARP Inspection

DHCP snooping is a security feature on network switches that defends against rogue DHCP servers. The switch classifies each port as trusted (uplinks toward the legitimate DHCP server) or untrusted (ports facing end hosts, the default). Server-originated messages such as DHCP Offers and Acks are only permitted on trusted ports — if one arrives on an untrusted port, the switch drops it, preventing an attacker from handing out bogus IP configurations that redirect traffic through a machine they control.

As it inspects this traffic, the switch builds the DHCP snooping binding table, recording each client's MAC address, leased IP address, port, and VLAN. The feature can also rate-limit DHCP messages to stop starvation attacks, in which an attacker floods requests to exhaust the server's address pool.

Dynamic ARP Inspection (DAI) extends this protection to ARP. In an ARP spoofing (poisoning) attack, a host sends gratuitous ARP replies binding another device's IP — often the default gateway — to the attacker's MAC address, enabling man-in-the-middle interception. DAI intercepts ARP packets on untrusted ports and validates them against the DHCP snooping binding table (or static ARP ACLs), dropping any ARP message whose IP-to-MAC mapping doesn't match a legitimate binding. Because DAI depends on the binding table, DHCP snooping is normally enabled first.

The CCNA exam tests both features within Layer 2 security fundamentals: know the trusted/untrusted port model, which DHCP message types are filtered, what the binding table contains, and how DAI uses it to stop ARP spoofing. Together with port security, these features form the exam's core toolkit for hardening access-layer switches.