This section describes how to prevent the attackers from attacking the Dynamic Host Configuration Protocol (DHCP) server by forging the DHCP packets for extending IP address leases.
Attackers disguise as authorized clients to send DHCP request packets for extending the IP address lease. As a result, DHCP servers cannot reclaim IP addresses assigned to clients.
This problem can be resolved by enabling DHCP snooping. After DHCP snooping is enabled, when receiving a DHCP request packet, the device checks whether the IP address and VLAN ID carried in the packet match an entry in the DHCP snooping binding table. If no matching entry exists, the device considers the DHCP request packet as a new request packet and forwards it. If a matching entry exists, the device considers the DHCP request packet as a lease renewal packet and checks whether the MAC address carried in the packet matches any entry in the binding table. If a matching entry exists, the device forwards the packet. If no matching entry exists, the device discards the packet.