20-2
Catalyst 2960 and 2960-S Switch Software Configuration Guide
OL-8603-09
Chapter 20 Configuring DHCP Features and IP Source Guard Features
Understanding DHCP Snooping
Understanding DHCP Snooping
DHCP is widely used in LAN environments to dynamically assign host IP addresses from a centralized
server, which significantly reduces the overhead of administration of IP addresses. DHCP also helps
conserve the limited IP address space because IP addresses no longer need to be permanently assigned
to hosts; only those hosts that are connected to the network consume IP a ddresses.
These sections contain this information:
• DHCP Server, page 20-2
• DHCP Relay Agent, page 20-2
• DHCP Snooping, page 20-2
• Option-82 Data Insertion, page 20-4
• DHCP Snooping Binding Database, page 20-7
• DHCP Snooping and Switch Stacks, page 20-8
For information about the DHCP client, see the “Configuring DHCP” section of the “IP Addressing and
Services” section of the Cisco IOS IP Configuration Guide, Release 12.2 from the Cisco.com page under
Documentation > Cisco IOS Software > 12.2 Mainline > Configuration Guides.

DHCP Server

The DHCP server assigns IP addresses from specified address pools on a switch or router to DHCP
clients and manages them. If the DHCP server cannot give the DHCP client the requested configuration
parameters from its database, it forwards the request to one or more seco ndary DHCP servers defined by
the network administrator.

DHCP Relay Agent

A DHCP relay agent is a Layer 3 device that forwards DHCP packets between clients and servers. Relay
agents forward requests and replies between clients and servers when they are n ot on the same physical
subnet. Relay agent forwarding is different from the normal Layer 2 forwarding, in which IP datagrams
are switched transparently between networks. Relay agents receive DHCP messages and generate new
DHCP messages to send on output interfaces.

DHCP Snooping

DHCP snooping is a DHCP security feature that provides network security by filtering untrusted DHCP
messages and by building and maintaining a DHCP snooping binding database, also referred to as a
DHCP snooping binding table.
DHCP snooping acts like a firewall between untrusted hosts and DHCP servers. You use DHCP snooping
to differentiate between untrusted interfaces connected to the end user and trusted interfaces connected
to the DHCP server or another switch.
Note For DHCP snooping to function properly, all DHCP servers must be connected to the switch through
trusted interfaces.