Definition
DHCP Snooping is a switch security feature that helps stop unauthorized DHCP servers from assigning network settings to clients.
How it works
Switch ports are marked trusted or untrusted. DHCP server replies on untrusted ports can be dropped, and the switch may record IP–MAC–VLAN–port bindings used by features such as Dynamic ARP Inspection. Exact behavior varies by vendor.
Real-world example
In a corporate access VLAN, only the uplink toward the legitimate DHCP infrastructure is trusted. An accidentally connected home router is then prevented from offering addresses to protected clients.
Limits and best practices
Configure trunks, relays and trusted ports carefully; check rate limits and binding-table persistence. Incorrect configuration can block legitimate leases and cause a widespread connectivity outage.