DHCP Snooping, Dynamic ARP Inspection and Storm Control

What it is

DHCP snooping, Dynamic ARP Inspection and storm control protect the address and traffic services that every Layer 2 network depends on.

DHCP and ARP have no authentication, so any host can answer. An attacker can hand out false settings, or lie about which MAC address owns an IP. These features let the switch decide which ports and which messages to believe.

How it works

Each feature builds on trusted and untrusted ports, and the first feeds the second.

DHCP snooping

DHCP snooping classifies ports as trusted or untrusted. Trusted ports lead to the real DHCP server, such as uplinks. Server messages, such as offers and acknowledgements, are dropped if they arrive on an untrusted port, which stops a rogue DHCP server.

The switch also builds a binding table. Each entry links a MAC address, an IP address, a VLAN, a port and a lease time.

Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10,20
Switch(config)# interface GigabitEthernet0/24
Switch(config-if)# ip dhcp snooping trust
Switch(config)# interface GigabitEthernet0/5
Switch(config-if)# ip dhcp snooping limit rate 15

Switch# show ip dhcp snooping
Switch# show ip dhcp snooping binding

The rate limit protects against DHCP starvation, where an attacker sends many requests with spoofed MAC addresses to exhaust the pool. Port security also helps, because it limits the MAC addresses per port. If a port exceeds the rate, it is err disabled.

Dynamic ARP Inspection

ARP spoofing sends false ARP replies, so that victims send traffic to the attacker. This is the basis of a man-in-the-middle attack on a local subnet. Dynamic ARP Inspection (DAI) checks ARP packets on untrusted ports against the DHCP snooping binding table.

An ARP packet that does not match a known binding is dropped. Trusted ports, such as uplinks to other switches, are not checked.

Switch(config)# ip arp inspection vlan 10,20
Switch(config)# ip arp inspection validate src-mac dst-mac ip
Switch(config)# interface GigabitEthernet0/24
Switch(config-if)# ip arp inspection trust
Switch(config)# interface GigabitEthernet0/5
Switch(config-if)# ip arp inspection limit rate 15

Switch# show ip arp inspection
Switch# show ip arp inspection statistics

The validate options add extra checks, such as that the source MAC in the Ethernet header matches the sender MAC in the ARP body. A host with a static IP address has no binding, so it needs an ARP access list.

Switch(config)# arp access-list STATIC-HOSTS
Switch(config-arp-nacl)# permit ip host 10.1.10.5 mac host 0011.2233.4455
Switch(config)# ip arp inspection filter STATIC-HOSTS vlan 10

Storm control

A storm is a flood of broadcast, multicast or unicast traffic that uses bandwidth and CPU. It may come from a loop, a faulty network card or an attack. Storm control measures traffic on a port over time and acts when it passes a threshold.

Switch(config)# interface GigabitEthernet0/5
Switch(config-if)# storm-control broadcast level 20
Switch(config-if)# storm-control multicast level 30
Switch(config-if)# storm-control action shutdown

Switch# show storm-control

The level is a percentage of the port bandwidth. The action can be to drop the excess traffic, to send an SNMP trap, or to shut the port down.

How the three work together

Enable snooping first, because DAI needs its bindings.