Instruction Manual
98
messages received on an untrusted interface from a device not listed in the
DHCP snooping table will be dropped.
•
Table entries are only learned for trusted interfaces. An entry is added or
removed dynamically to/from the DHCP snooping table when a client receives
or releases an IP address from a DHCP server. Each entry includes a MAC
address, IP address, lease time, VLAN identifier, and port identifier.
•
When DHCP snooping is enabled, DHCP messages entering an untrusted
interface are filtered based upon dynamic entries learned via DHCP snooping.
•
Filtering rules are implemented as follows:
•
If global DHCP snooping is disabled, all DHCP packets are forwarded.
•
If DHCP snooping is enabled globally, and also enabled on the VLAN where
the DHCP packet is received, all DHCP packets are forwarded to a trusted
port. If the received packet is a DHCP ACK message, a dynamic DHCP
snooping entry is also added to the binding table.
•
If DHCP snooping is enabled globally, and also enabled on the VLAN where
the DHCP packet is received, but the port is not trusted, it is processed as
follows:
•
If the DHCP packet is a reply packet from a DHCP server (including OFFER,
ACK or NAK messages), the packet is dropped.
•
If the DHCP packet is from a client, such as a DECLINE or RELEASE message,
the switch forwards the packet only if the corresponding entry is found in
the binding table.
