Configuring DHCP Snooping
D-Link Unified Wired and Wireless Access System
Oct. 2015 Page 257
D-Link UWS User Manual
DHCP Snooping Interface Configuration
The hardware rate limits DHCP packets sent to the CPU from untrusted interfaces to 15 packets per second.
There is no hardware rate limiting on trusted interfaces.
To prevent DHCP packets from being used as a DoS attack when DHCP snooping is enabled, the snooping
application enforces a rate limit for DHCP packets received on untrusted interfaces. DHCP snooping monitors
the receive rate on each interface separately. If the receive rate exceeds the configuration limit, DHCP
snooping brings down the interface. You must do “no shutdown” on this interface to further work with that
port. You can configure both the rate and the burst interval.
The DHCP snooping application processes incoming DHCP messages. For DHCPRELEASE and DHCPDECLINE
messages, the application compares the receive interface and VLAN with the client’s interface and VLAN in the
binding database. If the interfaces do not match, the application logs the event and drops the message. For
valid client messages, DHCP snooping compares the source MAC address to the DHCP client hardware address.
Where there is a mismatch, DHCP snooping logs and drops the packet. You can disable this feature using the
DHCP Snooping Interface Configuration page, shown in Figure 157 below, or by using the
no ip dhcp snooping
verify mac-address
command. DHCP snooping forwards valid client messages on trusted members within the
VLAN. If DHCP relay and/or DHCP server co-exist with the DHCP snooping, the DHCP client message will be sent
to the DHCP relay and/or DHCP server to process further.
To access the DHCP Snooping Interface Configuration page, click LAN > L2 Features > DHCP Snooping >
Interface Configuration in the navigation tree.
Figure 157: DHCP Snooping Interface Configuration
Table 140: DHCP Snooping Interface Configuration
Field Description
Interface Select the interface for which data is to be displayed or configured.
Trust State If it is enabled, the DHCP snooping application considers the port as trusted.
The default is Disable.
Logging Invalid Packets If it is enabled, the DHCP snooping application logs invalid packets on this
interface. The default is Disable.
To Next Page
Loading...
Need help?
General
Weight and Dimensions
