CCNA Notes

200-301 Exam Prep

Progress0/67

0% complete

Practice TestsNew
1Networking Devices2Interfaces And Cables3OSI Model and TCP/IP Suite4Intro to the CLI5Ethernet LAN Switching - Part 16Ethernet LAN Switching - Part 27IPv4 Addressing - Part 18IPv4 Addressing - Part 29Switch Interfaces10The IPv4 Header11Routing Fundamentals - Part 111Static Routing - Part 212Life of a Packet13Subnetting - Part 114Subnetting - Part 215Subnetting (VLSM) - Part 316VLANs - Part 117VLANs - Part 218VLANs - Part 319DTP / VTP20Spanning Tree Protocol - Part 121Spanning Tree Protocol - Part 222Rapid Spanning Tree Protocol23Etherchannel24Dynamic Routing25RIP / EIGRP26OSPF - Part 127OSPF - Part 228OSPF - Part 329First Hop Redundancy Protocol30TCP and UDP31IPv6 - Part 132IPv6 - Part 233IPv6 - Part 334Standard Access Control List35Extended Access Control List36CDP and LLDP37NTP - Network Time Protocol38DNS - Domain Name System39DHCP - Dynamic Host Configuration Protocol40SNMP - Simple Network Management Protocol41SYSLOG42SSH - Secure Shell43FTP and TFTP44NAT (Static) - Part 145NAT (Dynamic) - Part 246QoS (Voice VLAN) - Part 147QoS (Quality of Service) - Part 248Security Fundamentals49Port Security50DHCP Snooping51Dynamic ARP Inspection52LAN Architectures53WAN Architectures54Virtualization and Cloud - Part 154Virtualization (Containers) - Part 254Virtualization (VRF) - Part 355Wireless Fundamentals56Wireless Architectures57Wireless Security58Wireless Configuration59Introduction to Network Automation60JSON, XML, and YAML61REST APIs62Software Defined Networking63Ansible, Puppet, and Chef67CCNA Complete Cheatsheet
/DHCP Snooping
Topic 504 min read

DHCP Snooping

/
Tip: Select text to highlight or pin your reading position

50. DHCP SNOOPING (LAYER 2)

WHAT IS DHCP SNOOPING?

  • DHCP SNOOPING is a security feature of SWITCHES that is used to filter DHCP messages received on UNTRUSTED PORTS
  • DHCP SNOOPING only filters DHCP MESSAGES.
    • Non-DHCP MESSAGES are not affected
  • All PORTS are UNTRUSTED, by DEFAULT
    • Usually UPLINK PORTS are configured as TRUSTED PORTS, and DOWNLINK PORTS remain UNTRUSTED

imageClick to enlarge

imageClick to enlarge

ATTACKS ON DHCP

DHCP STARVATION

  • An example of a DHCP-based ATTACK is a DHCP STARVATION ATTACK
  • An ATTACKER uses spoofed MAC ADDRESSES to flood DHCP DISCOVER messages
  • The TARGET server’s DHCP POOL becomes full, resulting in a DoS to other DEVICES

imageClick to enlarge

DHCP POISONING (Man-in-the-Middle)

  • Similar to ARP POISONING, DHCP POISONING can be used to perform a Man-in-the-Middle ATTACK
  • A spurious DHCP SERVER replies to CLIENTS’ DHCP Discover messages and assigns them IP ADDRESSES but makes the CLIENTS use the spurious SERVER’S IP as a DEFAULT GATEWAY

** CLIENTS usually accept the first DHCP OFFER message they receive

  • This will cause the CLIENT to send TRAFFIC to the ATTACKER instead of the legitimate DEFAULT GATEWAY
  • The ATTACKER can then examine / modify the TRAFFIC before forwarding it to the legitimate DEFAULT GATEWAY

imageClick to enlarge

imageClick to enlarge

DHCP MESSAGES

  • When DHCP SNOOPING filters messages, it differentiates between DHCP SERVER messages and DHCP CLIENT messages

  • Messages sent by DHCP SERVERS:

    • OFFER
    • ACK
    • NAK = Opposite of ACK - used to DECLINE a CLIENT’S REQUEST

  • Messages sent by DHCP CLIENTS:

    • DISCOVER
    • REQUEST
    • RELEASE = Used to tell the SERVER that the CLIENT no longer needs its IP ADDRESS
    • DECLINE = Used to DECLINE the IP ADDRESS offered by a DHCP SERVER

HOW DOES IT WORK?

  • If a DHCP MESSAGE is received on a TRUSTED PORT, forward it as normal without inspection

  • If a DHCP MESSAGE is received on an UNTRUSTED PORT, inspect it and act as follows:

    • If it is a DHCP SERVER message, discard it
    • If it as a DHCP CLIENT message, perform the following checks:
      • DISCOVER / REQUEST messages :
        • Check if the FRAME’S SOURCE MAC ADDRESS and the DHCP MESSAGE’S CHADDR FIELDS match.
          • MATCH = FORWARD
          • MISMATCH = DISCARD
      • RELEASE / DECLINE messages:
        • Check if the PACKET’S SOURCE IP ADDRESS and the receiving INTERFACE match the entry in the DHCP SNOOPING BINDING TABLE
          • MATCH = FORWARD
          • MISMATCH = DISCARD

  • When a CLIENT successfully leases an IP ADDRESS from a SERVER, create a new entry in the DHCP SNOOPING BINDING TABLE

DHCP SNOOPING CONFIGURATION

imageClick to enlarge

SWITCH 2’s CONFIGURATION

imageClick to enlarge

SWITCH 1’s CONFIGURATION

imageClick to enlarge

DHCP SNOOPING RATE-LIMITING

  • DHCP SNOOPING can limit the RATE at which DHCP messages are allowed to enter an INTERFACE
  • If the RATE of DHCP messages crosses the configured LIMIT, the INTERFACE is err-disabled
  • Like with PORT SECURITY, the interface can be manually re-enabled, or automatically re-enabled with errdisable recovery

imageClick to enlarge

  • You wouldn’t set the limit rate to 1 since it’s so low, it would shut the port immediately but this shows how RATE-LIMITING works

errdisable recovery cause dhcp-rate-limit

imageClick to enlarge

DHCP OPTION 82 (INFORMATION OPTION)

  • OPTION 82, also known as a ‘DHCP RELAY AGENT INFOMRATION OPTION’ is one of MANY DHCP OPTIONS
  • It provides additional information about which DHCP RELAY AGENT received the CLIENT’S message, on which INTERFACE, in which VLAN, etc.
  • DHCP RELAY AGENTS can add OPTION 82 to message they forward to the remote DHCP SERVER
  • With DHCP SNOOPING enabled, by default Cisco SWITCHES will add OPTION 82 to DHCP messages they receive from CLIENTS, even if the SWITCH isn’t acting as a DHCP RELAY AGENT
  • By DEFAULT, Cisco SWITCHES will drop DHCP MESSAGES with OPTION 82 that are received on an UNTRUSTED PORT

imageClick to enlarge

THIS command disables OPTION 82 for SW1 but NOT SW2

imageClick to enlarge

TRAFFIC gets passed to R1 and is DROPPED because of “inconsistent relay information” (packet contains OPTION 82 but wasn’t dropped by SW2)

imageClick to enlarge

By ENABLING OPTION 82 on both SWITCHES…

imageClick to enlarge

PC1’s DHCP DISCOVER message gets passed, through SW1 and SW2, to R1. R1 responds with an DHCP OFFER message, as normal

imageClick to enlarge

COMMAND SUMMARY

imageClick to enlarge

PreviousPort Security
NextDynamic ARP Inspection