From DHCP lease to ARP check
Draw the trust boundary
Once snooping is on, every port is untrusted. Trust only the ports that lead toward the real DHCP server: uplinks and the server’s own port.
Filter server messages
On untrusted ports the switch accepts client messages (Discover, Request) and drops server messages (Offer, Ack), so a rogue server plugged into an access port reaches no one.
Record the lease
Each Ack that comes back through a trusted port adds a row to the binding table: client MAC, leased IP, lease time, VLAN and access port.
Inspect ARP
With DAI enabled on the VLAN, ARP requests and replies from untrusted ports are compared with those rows. A sender IP and MAC pair with no matching row is dropped and logged.
Pass trusted ARP
ARP arriving on a DAI-trusted port is not checked, which is why switch-to-switch uplinks are trusted for both features.
The attack DAI stops
- 0000 An access-port host claims the gateway’s IP with its own MAC
- 0010 The switch compares the sender IP and MAC with the snooped leases
- 0020 No matching row
- 0030 ARP dropped, logged
- 0040 Their ARP caches were never poisoned
Turning both on
An access switch with users on VLANs 30 and 31 and the DHCP server reached through Gi1/0/48
ip dhcp snoopingip dhcp snooping vlan 30,31ip arp inspection vlan 30,31!interface GigabitEthernet1/0/48 description uplink toward the DHCP server ip dhcp snooping trust ip arp inspection trust!interface range GigabitEthernet1/0/1 - 24 ip dhcp snooping limit rate 15!show ip dhcp snooping bindingshow ip arp inspection vlan 30The global ip dhcp snooping line and the per-VLAN line are both needed; with only one, snooping stays off. The rate limit on access ports caps DHCP messages per second, a guard against address-pool starvation.
Defaults that decide whether it works
| Item | Default | What it means for you |
|---|---|---|
| Port trust, DHCP snooping | Untrusted | Forget the uplink and every legitimate Offer is dropped: clients get no address. |
| Port trust, DAI | Untrusted | Forget the uplink and ARP from hosts behind other switches is checked against a table that does not list them. |
| DAI rate limit, untrusted ports | 15 ARP packets per second | A port that exceeds it is err-disabled. |
| Hosts with static addresses | No binding row | Their ARP is dropped unless an ARP ACL or a static binding covers them. |
| Port security, if also used | 1 MAC address; violation mode shutdown | Protect and restrict drop offending frames without err-disabling the port. |
If clients lose their addresses after you enable it
- The uplink toward the server carries
ip dhcp snooping trust. - Both the global and the per-VLAN snooping commands are in the configuration.
- The relay or server accepts DHCP option 82, which snooping inserts by default, or insertion is off with
no ip dhcp snooping information option. - Printers, servers and other static-address devices have an ARP ACL or static binding before DAI goes on.
show interfaces status err-disabledlists no port tripped by the ARP rate limit.
Frames on DHCP snooping and DAI
Name the feature, then the table it reads or writes; most of these frames turn on that pairing.
Practice frames written by our editors for study, not Cisco items. The 200-301 exam itself mixes multiple choice, drag-and-drop and lab-style items.
Frame 001 of 007 · 0 answered · 0 ok
Keys
1–5 or A–E pick an option (on choose-N frames they toggle; then Check answer) · ← → previous / next frame · ↑ ↓ move in the frame list
- Frame 001 of 007
In which scenario is DHCP spoofing utilized as an attack vector?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: in DHCP spoofing, a rogue server answers clients first and hands out its own gateway or DNS address, putting the attacker in the path.
Note on B
An ARP request for the gateway’s MAC is normal host behavior, not an attack.
Note on C
Asking the real server for an address is what every normal client does.
Note on D
Flooding the server with Discover messages is DHCP starvation, which drains the pool rather than impersonating a server.
Best answer: A · why
In a DHCP spoofing attack, a rogue DHCP server on the LAN replies to client Discover messages. Its offers set the attacker as the default gateway or DNS server, which enables man-in-the-middle attacks. DHCP starvation is a different attack that drains the real server’s pool, often as a first step. DHCP snooping stops spoofing by dropping server messages on untrusted ports.
- Frame 002 of 007
Which Layer 2 security feature prevents unauthorized DHCP servers from responding to client requests?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: DHCP snooping drops server messages such as OFFER and ACK that arrive on untrusted ports, so only trusted uplinks reach the real server.
Note on B
Storm control limits broadcast, multicast or unicast floods by rate; it cannot tell a rogue DHCP server from a real one.
Note on C
Root guard keeps a port from becoming a path to a new STP root bridge; it has nothing to do with DHCP.
Note on D
Port security limits which or how many MAC addresses a port learns, but a rogue server with an allowed MAC still gets through.
Best answer: A · why
DHCP snooping classifies switch ports as trusted (uplinks toward the real DHCP server) or untrusted (access ports). Server messages such as OFFER and ACK that arrive on an untrusted port are dropped, so a rogue server cannot answer clients. Snooping also builds a binding table of MAC, IP, VLAN and port, which Dynamic ARP Inspection and IP Source Guard then use.
- Frame 003 of 007
Which command enables DHCP snooping on a Cisco switch for VLAN 10?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
The keyword is snooping, not inspection, and the command also needs the ip prefix.
Note on B
ip … inspection is the pattern of Dynamic ARP Inspection commands, not of DHCP snooping.
Note on C
Correct: ip dhcp snooping vlan 10 enables snooping on that VLAN, and it also needs the global ip dhcp snooping command.
Note on D
IOS DHCP snooping commands start with ip, so dhcp snooping vlan 10 is rejected.
Best answer: C · why
DHCP snooping is enabled in two steps in global configuration: ip dhcp snooping turns the feature on, and ip dhcp snooping vlan 10 applies it to VLAN 10. The uplink toward the real server is then marked with ip dhcp snooping trust in interface mode; every other port is untrusted by default. Dynamic ARP Inspection uses a different command, ip arp inspection vlan <list>.
- Frame 004 of 007
Which security feature prevents ARP spoofing attacks by validating ARP packets against a trusted database?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
DHCP snooping builds the trusted binding table, but it is DAI that checks ARP packets against it.
Note on B
Port security limits which MAC addresses a port learns; it never looks inside ARP messages.
Note on C
Correct: DAI intercepts ARP packets on untrusted ports and drops any whose MAC-to-IP pairing is not in the DHCP snooping binding table.
Note on D
IP Source Guard filters IP traffic by source address using the binding table; it does not inspect ARP.
Best answer: C · why
ARP spoofing works by sending forged ARP replies that tie the attacker’s MAC to someone else’s IP, often the gateway. Dynamic ARP Inspection checks every ARP packet on untrusted ports against the DHCP snooping binding table (or static ARP ACLs) and drops mismatches. DHCP snooping supplies the table, and IP Source Guard uses it to filter IP packets instead of ARP.
- Frame 005 of 007
Which command enables Dynamic ARP Inspection on a Cisco switch for VLANs 10-20?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
The keywords are out of order: the IOS syntax is ip arp inspection.
Note on B
IOS has no arp dynamic-inspection command.
Note on C
Correct: ip arp inspection vlan 10-20 enables DAI on VLANs 10 through 20, relying on DHCP snooping bindings for those VLANs.
Note on D
The command needs the ip prefix; arp inspection vlan 10-20 on its own is not valid.
Best answer: C · why
DAI is enabled per VLAN in global configuration with ip arp inspection vlan <range>. Ports default to untrusted, and uplinks toward other switches or the gateway are trusted with ip arp inspection trust. DAI validates ARP against the DHCP snooping binding table, so ip dhcp snooping and ip dhcp snooping vlan 10-20 should already be in place, and hosts with static addresses need ARP ACLs.
- Frame 006 of 007
Before enabling dynamic ARP inspection (DAI) on a Cisco switch, which prerequisite must be configured to ensure proper operation?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
Correct: DAI checks ARP packets against the IP-to-MAC bindings that DHCP snooping learns, so snooping must run first or valid ARP on untrusted ports is dropped.
Note on B
Port security is a separate feature that limits MAC addresses, and DAI does not depend on it.
Note on C
VPNs have nothing to do with Layer 2 ARP validation on a switch.
Note on D
Routing protocols keep running normally; DAI works on ARP inside each VLAN.
Best answer: A · why
Dynamic ARP Inspection needs a trusted list of IP-to-MAC pairings to compare ARP packets against. On most networks that list is the DHCP snooping binding table, so DHCP snooping must be enabled on the same VLANs first. Hosts with static addresses are not in the table; they need ARP ACLs, or their ARP traffic will be dropped on untrusted ports.
- Frame 007 of 007
How does dynamic ARP inspection (DAI) enhance layer 2 security on Cisco switches?
Pick an option. The verdict shows here; open the note under any option to see why.
Note on A
DAI does not create ARP entries; it validates the ARP messages that hosts send.
Note on B
DAI inspects ARP only and does not block broadcasts, which ARP requests themselves rely on.
Note on C
Correct: on untrusted ports, DAI drops ARP packets whose IP-to-MAC pairing does not match the DHCP snooping binding table.
Note on D
ARP has no encryption, and DAI does not add any; it validates and drops forged packets.
Best answer: C · why
DAI stops ARP spoofing and the man-in-the-middle attacks built on ARP poisoning. The switch intercepts ARP requests and replies on untrusted ports, compares the sender IP and MAC with the DHCP snooping binding table (or ARP ACLs), and drops any mismatch. It can also rate-limit ARP on untrusted ports, 15 packets per second by default, and err-disable a port that exceeds the limit.
Snooping and DAI in short
Is DHCP snooping related to IGMP snooping?
Only by name. IGMP snooping is a multicast feature that forwards group traffic only to ports with listeners; it does nothing for address security.
Can DAI work without DHCP?
Yes, with an ARP access list of permitted IP and MAC pairs, applied to the VLAN with ip arp inspection filter. A host covered by neither a binding nor a filter entry has its ARP dropped on untrusted ports.
How is DAI different from an IP access list?
An IP ACL filters packets by address and port fields, using wildcard masks to choose ranges (how wildcard masks match addresses). DAI looks only at ARP messages and checks the IP-to-MAC pairing against the binding table, so it catches a host lying about which MAC owns an address, something an ACL cannot see.