Filter
Top Products
Switching Configuration 57
The hardware rate limits DHCP packets sent to the CPU from interfaces to 64 Kbps.
The DHCP snooping application processes incoming DHCP messages. For DHCPRELEASE and
DHCPDECLINE messages, the application compares the receive interface and VLAN with the client
interface and VLAN in the bindings database. If the interfaces do not match, the application logs the
event and drops the message. For valid client messages, DHCP snooping compares the source MAC
address to the DHCP client hardware address. When there is a mismatch, DHCP snooping logs and
drops the packet. The network administrator can disable this feature using the no ip dhcp snooping
verify mac-address command. DHCP snooping forwards valid client messages on trusted members
within the VLAN. If DHCP relay co-exists with DHCP snooping, DHCP client messages are sent to
DHCP relay for further processing.
The DHCP snooping application uses DHCP messages to build and maintain the binding's database.
The binding's database only includes data for clients on untrusted ports. DHCP snooping creates a
tentative binding from DHCP DISCOVER and REQUEST messages. Tentative bindings tie a client to a
port (the port where the DHCP client message was received). Tentative bindings are completed when
DHCP snooping learns the client's IP address from a DHCP ACK message on a trusted port. DHCP
snooping removes bindings in response to DECLINE, RELEASE, and NACK messages. DHCP
Snooping application ignores the ACK messages as reply to the DHCP Inform messages received on
trusted ports. The administrator can also enter static bindings into the binding database.
The DHCP binding database resides on a configured external server or locally in flash depending upon
the user configuration. When a switch learns of new bindings or when it loses bindings, the switch
immediately updates the entries in the database. The switch also updates the entries in the bindings file.
The frequency at which the file is updated is based on a configurable delay, and the updates are batched.
If the absolute lease time of the snooping database entry expires, the entry is removed. If the system time
is not consistent across reboots, snooping entries will not expire properly. If a host sends a DHCP release
while the switch is rebooting, when the switch receives the DHCP discovery or request, the client's
binding will go to the tentative binding.