# DHCP Snooping
**URL:** https://forum.networklessons.com/t/dhcp-snooping/1156
**Category:** Lessons Discussion
**Created:** [December 27, 2016, 4:47pm UTC](https://forum.networklessons.com/t/dhcp-snooping/1156 "2016-12-27T16:47:21Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [December 27, 2016, 4:47pm UTC](https://forum.networklessons.com/t/dhcp-snooping/1156/1 "2016-12-27T16:47:21Z")
This topic is to discuss the following lesson:
> **[DHCP Snooping](https://networklessons.com/switching/dhcp-snooping)**
>
> This lesson explains how DHCP snooping protects your DHCP clients and how to configure it on Cisco Swithes.
---
### Author:  [@ramonsito](https://forum.networklessons.com/u/ramonsito)
#### Post date: [November 30, 2014, 6:58pm UTC](https://forum.networklessons.com/t/dhcp-snooping/1156/2 "2014-11-30T18:58:21Z")
Hi Rene,
question, I’m working with cisco 3550 switch, version 12.1 (13) , (C3550-I5Q3L2-M), and it doesn’t have the option # ip dhcp snooping, under # ip dhcp just have this options (conflict, database, excluded-address, limited-broadcast-address, ping, pool, relay, smart-relay). what should i do, it seems to be a version issue, what version should i upgrade the switch or any other advice.
thanks
Ramon
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [December 1, 2014, 10:49am UTC](https://forum.networklessons.com/t/dhcp-snooping/1156/3 "2014-12-01T10:49:29Z")
Hi Ramon,
It’s probably the version since the 3550 does support DHCP snooping. It’s best to get one of the “IP services” images. This is what you should do:
Go to [Cisco.com](http://Cisco.com) -\> Support.
Select the 3550.
Select Download Software.
Select one of the EMI versions.
Select Downloads.
Select IOS Software.
The latest “IP services” version is “c3550-ipservices-mz.122-44.SE6.bin” but an older version would also work.
Here’s the direct link if you want:
[https://software.cisco.com/download/release.html?mdfid=275935148&softwareid=280805680&os=&release=12.2.44-SE6&relind=AVAILABLE&rellifecycle=&reltype=latest&i=!pp](https://software.cisco.com/download/release.html?mdfid=275935148&softwareid=280805680&os=&release=12.2.44-SE6&relind=AVAILABLE&rellifecycle=&reltype=latest&i=!pp)
---
### Author:  [@281332](https://forum.networklessons.com/u/281332)
#### Post date: [February 4, 2015, 5:16pm UTC](https://forum.networklessons.com/t/dhcp-snooping/1156/4 "2015-02-04T17:16:04Z")
Hi Rene, could you describe using your simply language, for what we need option 82?
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [February 6, 2015, 2:47pm UTC](https://forum.networklessons.com/t/dhcp-snooping/1156/5 "2015-02-06T14:47:27Z")
Hi Yevgeniy,
DHCP Option 82 stands for “DHCP Relay Agent Information Option”. If you haven’t seen how DHCP relay works before, take a look at this lesson:
> **[Cisco IOS DHCP Relay Agent](https://networklessons.com/ip-services/cisco-ios-dhcp-relay-agent)**
>
> This tutorial explains the DHCP Relay Agent and demonstrates how to configure this on Cisco IOS routers with the ip helper-address command.
Option 82 was originally created for really large (WAN) networks where we have a lot of DHCP relays and central DHCP servers. The idea behind it is that the DHCP relay can add extra information which the DHCP server can use to decide which pool to use for assigning an IP address. Option 82 has a “Circuit ID” and a “Remote ID”.
The Circuit ID has information that identifies the port where the request came from. It could carry something like:
Router interface number
VLAN information
Switching Hub port number
Remote Access Server port number
Frame Relay DLCI
ATM virtual circuit number
Cable Data virtual circuit number
The remote ID adds information about the DHCP relay, it could contain something like:
Caller ID (telephone number) for dial-up connections.
username
modem ID
remote IP of point-to-point link
Option 82 is decribed in RFC 3046 in 2001 so it’s quite old. It’s not used often on (small) LAN networks.
Does this help a bit? Maybe I should do a proper lesson for option 82 with some debugs etc.
Rene
---
### Author:  [@Openlearner](https://forum.networklessons.com/u/Openlearner)
#### Post date: [February 28, 2015, 1:43am UTC](https://forum.networklessons.com/t/dhcp-snooping/1156/6 "2015-02-28T01:43:55Z")
Hi Rene,
If we consider configuring DHCP SNOOPING on your first diagram with 4 switches and those switches are trunking, would you configure all those trunks or port-channels as dhcp snooping trusted? or will you configure the SVI’s on the Core switches as trusted? Which is the best way to configure them.
Please advise
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [March 10, 2015, 10:52am UTC](https://forum.networklessons.com/t/dhcp-snooping/1156/7 "2015-03-10T10:52:21Z")
Hi Alfredo,
Sorry for the late reply, just got back from holiday 🙂 It’s best to configure the uplink trunks / port-channels as trusted.
Rene
---
### Author:  [@ken2006](https://forum.networklessons.com/u/ken2006)
#### Post date: [April 13, 2016, 3:30am UTC](https://forum.networklessons.com/t/dhcp-snooping/1156/8 "2016-04-13T03:30:46Z")
In the output of “show ip dhcp snooping” above it shows the insertion of option 82 as enabled. I thought it would not show this as you issued
the no ip dhcp snooping information option earlier?
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [April 17, 2016, 4:18pm UTC](https://forum.networklessons.com/t/dhcp-snooping/1156/9 "2016-04-17T16:18:01Z")
Hi Ken,
You are right, that’s what it should show. It could be a cosmetic bug in the IOS version that I used for this example or I might have run the show command before disabling the insertion of option 82.
Here’s what it should show, just checked it on an IOS 15.x switch:
```auto
SW1#show ip dhcp snooping | include option 82
Insertion of option 82 is disabled
```
Rene
---
### Author:  [@bishoy\_atef54](https://forum.networklessons.com/u/bishoy_atef54)
#### Post date: [April 23, 2016, 1:16pm UTC](https://forum.networklessons.com/t/dhcp-snooping/1156/10 "2016-04-23T13:16:35Z")
Hi Rene,
I have question why not apply command IP DHCP snooping trust on interface than connected to client (f0/1) .
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [April 23, 2016, 1:51pm UTC](https://forum.networklessons.com/t/dhcp-snooping/1156/11 "2016-04-23T13:51:21Z")
Hi Bishoy,
We only configure interfaces as trusted if the interface is connected to an DHCP server or if it’s an uplink towards the DHCP server.
If you would configure the fa0/1 interface as trusted, the client could run a fake DHCP server which is exactly what we are trying to prevent here 🙂
Rene
---
### Author:  [@Zaman.rubd](https://forum.networklessons.com/u/Zaman.rubd)
#### Post date: [May 18, 2016, 12:59pm UTC](https://forum.networklessons.com/t/dhcp-snooping/1156/12 "2016-05-18T12:59:24Z")
Hlw Rene,
It is very basic question still curious to understand. My router shows the output
```auto
Router-1#show version
Cisco IOS XE Software, Version 03.12.00a.S - Standard Support Release
Cisco IOS Software, ASR1000 Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 15.4(2)S0a, RELEASE SOFTWARE (fc1)
```
I want to know ---------------
What is the meaning of `Version 03.12.00a.S and Version 15.4(2)S0a` ?
I am very much confused on it . Please help me to understand dear 🙂
br//
zaman
---
### Author:  [@andrew](https://forum.networklessons.com/u/andrew)
#### Post date: [May 19, 2016, 11:46pm UTC](https://forum.networklessons.com/t/dhcp-snooping/1156/13 "2016-05-19T23:46:43Z")
Zaman,
IOS XE is a different from the “traditional” IOS operating system in terms of its architecture. IOS XE still runs the traditional IOS, but it runs as a single process (daemon) within a larger linux operating system. Notice in your output, there is an indication of this (linux):
`(X86_64_LINUX_IOSD-UNIVERSALK9-M)`
So, “Version 03.12.00a.S” refers to the large linux operating system, while “Version 15.4(2)S0a” refers to the IOS version being run by the IOS daemon within IOS XE. Make sense?
Here’s some more info on IOS XE if you want to read about the new architectural changes:
[http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-xe-3sg/QA\_C67-622903.html](http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-xe-3sg/QA_C67-622903.html)
---
### Author:  [@rudyirawan](https://forum.networklessons.com/u/rudyirawan)
#### Post date: [August 3, 2016, 1:57am UTC](https://forum.networklessons.com/t/dhcp-snooping/1156/14 "2016-08-03T01:57:43Z")
Hello Rene,
Can you give me please example if DHCP Snooping combine with DHCP Relay agent if use additional Switch or router.
Thanks
---
### Author:  [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [August 4, 2016, 5:01pm UTC](https://forum.networklessons.com/t/dhcp-snooping/1156/15 "2016-08-04T17:01:23Z")
Hello Rudy.
A DHCP relay agent is just a router that receives a DHCP OFFER packet and forwards it to a preconfigured DHCP server that is on a different subnet than the interface on which the OFFER was received. This is a layer 3 feature since we are taking a packet that would normally be limited to a subnet and routing it to the DHCP server on another subnet.
The DHCP snooping occurs only within a subnet and cannot surpass the boundary of the subnet (the router) unless the router itself is configured with the IP address of the “DHCP snooper” as the relay agent. Although this theoretically can occur, it is not likely and it is of little value to an attacker.
So weather you have a relay agent or not, snooping will still occur and can be mitigated in the same manner.
I hope this has been helpful.
Laz
---
### Author:  [@markscottuk1979](https://forum.networklessons.com/u/markscottuk1979)
#### Post date: [January 25, 2017, 7:37pm UTC](https://forum.networklessons.com/t/dhcp-snooping/1156/16 "2017-01-25T19:37:55Z")
apologies to jump in on an old thread, would the cross link between the 2 distribution switches need to be enabled for IP DHCP snooping trust on both ends?
---
### Author:  [@andrew](https://forum.networklessons.com/u/andrew)
#### Post date: [January 28, 2017, 7:13pm UTC](https://forum.networklessons.com/t/dhcp-snooping/1156/17 "2017-01-28T19:13:54Z")
Hi Mark,
Yes, all ports in that form part of the “downstream” path FROM the trusted DHCP server also need to be marked as trusted. This would include inter-switch links. The reverse is not necessary (upstream ports to the DHCP server). The reason for this is because DHCP snooping blocks the Offer message from crossing untrusted ports. The client side of the conversation–the Discovery and Request (remember DORA for DHCP ipv4), is not affected by DHCP snooping.
---
### Author:  [@manuelchocolat1981](https://forum.networklessons.com/u/manuelchocolat1981)
#### Post date: [April 26, 2017, 4:08pm UTC](https://forum.networklessons.com/t/dhcp-snooping/1156/18 "2017-04-26T16:08:58Z")
Hello Rene,
Can you please provide strong details why do you have to disable option 82 on an interface? i have a little idea of what it is but i need a really good example when it need to be activated and disable.
---
### Author:  [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [May 9, 2017, 6:37am UTC](https://forum.networklessons.com/t/dhcp-snooping/1156/19 "2017-05-09T06:37:27Z")
Hello Manuel
Rene describes what option 82 does in [this post](https://forum.networklessons.com/t/dhcp-snooping/1156/5) very well.
As to why you should disable option 82, when DHCP snooping is enabled on a switch, option 82 is enabled by default. That is, any DHCP request packets that are sent from a host will enter the switch and will have option 82 information ADDED to the request before it is sent on to the DHCP server. Specifically, enabling DHCP snooping on the switch adds the `giaddr` value of `0.0.0.0` in the DHCP packet. However, the DHCP server is expecting this field to be set to that of the relay agent (a non zero value), since option 82 is used for DHCP relay. (If you’re not sure what I mean, review the post I linked to above).
The problem is that there are some DHCP servers (including Cisco IOS DHCP servers) that will reject any DHCP packet that retains the `giaddr` value of `0.0.0.0` in the DHCP packet.
So this is why you should use the `no ip dhcp-snooping information option` described by Rene. This command tells the switch NOT to add option 82 and thus, any DHCP server receiving the DHCP request will process it normally. Another solution would be to use the command` ip dhcp relay information trusted` on the interface of the DHCP server which will tell it to trust any relay information, that is option 82 information, provided by the packet.
I hope this has been helpful!
Laz
---
### Author:  [@rosna185](https://forum.networklessons.com/u/rosna185)
#### Post date: [January 23, 2018, 12:46am UTC](https://forum.networklessons.com/t/dhcp-snooping/1156/20 "2018-01-23T00:46:59Z")
What will happen if a DHCP server becomes a shortage of IP Address? Suppose in a Scenario an attacker sends unlimited DHCP requests to the DHCP Server and DHCP server goes out of IP Address after assigning all of its valid IP Addresses. (Somehow attacker manages to configure its device each time such as does not have an IP Address assigned. It would be great if you can explain the attack as well. )
[Next page](https://forum.networklessons.com/t/dhcp-snooping/1156.md?page=2)