This section describes how to prevent attackers from attacking the Dynamic Host Configuration Protocol (DHCP) server by modifying the client hardware address (CHADDR) field.
Attackers may change the CHADDR field carried in DHCP packets to apply for IP addresses continuously. The device, however, only checks validity of packets based on the source media access control (MAC) address in the frame header. Attack packets can still be forwarded and the MAC address limit cannot take effect.
To prevent the attacker from changing the CHADDR field, configure DHCP snooping to check the CHADDR field carried in DHCP request packets. If the CHADDR field matches the source MAC address in the frame header, the packet is forwarded. Otherwise, the packet is discarded.