DHCP Snooping: The Rogue Router

"Who Is the Captain Now?"

This is one of the most common causes of "the internet is down" in large offices, and it's almost always caused by a well-intentioned employee, not a malicious attacker.

Understanding the Attack First:

DHCP (Dynamic Host Configuration Protocol) is how devices get their IP address, subnet mask, default gateway, and DNS server when they connect to a network. A device broadcasts "I need an IP address!" and the DHCP server responds with a lease. The problem: any device on the network can respond to that broadcast. There is no built-in authentication in DHCP.

The Rogue DHCP Scenario:

1. An employee's desk has weak WiFi signal. They bring a cheap home router from Amazon.
2. They plug the LAN port (not the WAN port) of their home router into the office wall jack. This is the critical mistake — the LAN port makes the router act as a switch and DHCP server on the corporate network.
3. The home router starts broadcasting DHCP offers with addresses like 192.168.1.50, a default gateway of 192.168.1.1 (the home router itself), and DNS pointing to 8.8.8.8.
4. Nearby devices that happen to receive the rogue offer before the legitimate server responds accept the bad configuration.
5. Those devices now route all traffic through the home router, which has no uplink to the corporate network — so they lose access to internal resources. Some lose internet entirely.

The employee is confused. The network admin gets a flood of tickets. The root cause takes 20 minutes to find.

The Defense: DHCP Snooping

DHCP Snooping is a feature on managed switches that enforces a simple rule: only specific, trusted ports are allowed to send DHCP server responses (OFFER, ACK packets). All other ports are untrusted and may only send DHCP client requests (DISCOVER, REQUEST).

Configuration on a Cisco-style switch:

! Enable DHCP Snooping globally
ip dhcp snooping

! Enable it on the corporate VLAN
ip dhcp snooping vlan 10

! Mark the uplink to the real DHCP server as trusted
interface GigabitEthernet0/48
  ip dhcp snooping trust

! All other ports (0/1 through 0/47) are untrusted by default
! If a DHCP OFFER arrives on an untrusted port, the switch drops it
! and can optionally err-disable the port

When the rogue router sends a DHCP OFFER from port GigabitEthernet0/12 (an untrusted access port), the switch drops the packet silently. The employee's devices never see the bad offer. The legitimate DHCP server on the trusted uplink continues to work normally.

The DHCP Snooping Binding Table:

A secondary benefit: DHCP Snooping builds a binding table that maps MAC addresses to IP addresses, switch ports, and VLANs. This table is used by two other security features:

• Dynamic ARP Inspection (DAI): Validates ARP packets against the binding table to prevent ARP spoofing/poisoning attacks.
• IP Source Guard: Drops packets from a port if the source IP doesn't match the binding table entry for that port — prevents IP address spoofing.

These three features (DHCP Snooping → DAI → IP Source Guard) form a layered defense against the most common Layer 2 attacks in office environments.