How can DHCP spoofing attacks be mitigated?

Question

BlackTom AI · Accepted Answer

DHCP snooping enforces a trust model: only interfaces explicitly configured as “trusted” are allowed to forward DHCP server messages (DHCPOFFER, DHCPACK). This prevents a rogue DHCP server on an untrusted access port from handing out IP settings and redirecting or intercepting traffic.

Relevant concepts:
- DHCP spoofing: an attacker runs a rogue DHCP server that responds to DHCPDISCOVER, supplying malicious IP, gateway, or DNS settings.
- DHCP snooping: a Layer 2 security feature that classifies ports as trusted or untrusted, blocks DHCP server messages from untrusted ports, and builds a DHCP binding table (MAC–IP–lease–port–VLAN).
- Supporting features: IP Source Guard and Dynamic ARP Inspection use the DHCP snooping binding table to enforce further protections.

Step-by-step reasoning and configuration flow:
1. Enable DHCP snooping globally: ip dhcp snooping
2. Enable snooping per VLAN: ip dhcp snooping vlan <vlan-id>
3. Mark legitimate DHCP server-facing interfaces as trusted: interface Gi0/1 -> ip dhcp snooping trust
4. All other access ports remain untrusted by default; the switch will drop DHCP server packets (DHCPOFFER/DHCPACK) received on untrusted ports.
5. Verify bindings: show ip dhcp snooping binding

Why this mitigates DHCP spoofing:
- A rogue server on an untrusted port cannot deliver lease offers because the switch filters its DHCP server messages, so clients only accept offers from the legitimate, trusted server. The DHCP snooping binding table also enables downstream protections if desired.

Why the other options are incorrect:
- Disabling DTP on nontrunking ports protects against trunk-hopping/VLAN issues, not DHCP spoofing.
- The ip verify source (IP Source Guard) command prevents hosts from using unauthorized IPs but does not by itself block a rogue DHCP server’s offers; it actually depends on DHCP snooping’s binding table to be effective.
- Port security limits MAC addresses per port (mitigates MAC flooding/spoofing) but does not stop a rogue DHCP server from sending DHCP server messages.

Conclusion: Implementing DHCP snooping on trusted ports is the correct mitigation (matches the provided answer).

How can DHCP spoofing attacks be mitigated?单项选择题

类似问题

Which answer choice explains why furanoses and pyranoses can be reduced by sodium borohydride despite having no carbonyl functional groups.

Which of the following statements describes a glycoside?

Which of the following structures represents chitin?

In solution, glucose exists in

According to Xenophanes, what should be avoided at a symposium?

What is "kottabos"?

Why are there so many naked figures in vase iconography?

Why was it necessary to have a "hydria" as part of the ceramic vessels used at a symposium?

更多留学生实用工具

智能学习助手

风格化写作助手

论文查重助手

文献引用助手

课堂转译助手

课堂笔记助手

Quiz搜索助手

学校历年真题

智能刷题助手

智能匹配练习

希望你的学习变得更简单