Ping Labz
Sign up
Labs · · 4 min read

Lab sec-05 - DHCP Snooping and Dynamic ARP Inspection

Lab sec-05 - DHCP Snooping and Dynamic ARP Inspection - PingLabz Labs article title card

DHCP snooping watches DHCP traffic on a switch and builds a binding table of legitimate IP-MAC-port mappings. Dynamic ARP Inspection (DAI) uses that binding table to verify ARP packets: if an ARP claims an IP that does not match a snooping entry, the ARP is dropped. Together they stop DHCP starvation attacks, rogue DHCP servers, and ARP poisoning. This lab configures both on SW1.

What you will learn

  • The DHCP snooping binding table - what it tracks and how
  • Trusted vs untrusted ports
  • Configuring DAI to verify ARPs against the binding table
  • How to read show ip dhcp snooping and show ip arp inspection

What this lab does NOT cover

  • IP Source Guard (related feature, builds on DHCP snooping)
  • Static DHCP snooping bindings for hosts with manual IPs

Topology

Download the CCNA Base Topology .yaml

3 iol-xe routers + 1 alpine + 1 ioll2-xe managed switch + 1 unmanaged switch.

Download CCNA Base Topology

Share Share Share Share Share Email

Read next

Terminal card showing a repeating CDP native VLAN mismatch log naming Ethernet0/0 native VLAN 1 against SW2 Ethernet0/0 native VLAN 99
VLANs ·

Native VLAN Mismatch: Read the CDP Log, Fix the Trunk

%CDP-4-NATIVE_VLAN_MISMATCH hands you both interfaces and both native VLANs in one line. The real damage is underneath it: untagged frames get re-homed at the trunk boundary and two VLANs quietly become one. Captured live on IOS XE 17.18.2 in CML.