Hi,
So i try to correlate switchport port security, dhcp snooping, DAI and IPSG , do you think my understanding below is correct?
port security: per port basis , when device connect to the port that has port security mac-address H.H.H enabled, it only check MAC address, doesn’t consider about the MAC-IP mapping
DHCP Snooping：per switch basis, main purpose is to drop malicious DHCP offer/ack packets. for devices that connect to the switch that has DHCP snooping enabled, it only obtain IP from the trust port that connects to the DHCP server
DAI: per switch basis, for devices that connect to the switch, switch check DHCP snooping DB and see whether the mac - ip mapping match the connected device IP/MAC, if it’s not matched, ARP reply will be dropped.
IPSG: per port basis, when device connect to the port, it check the DHCP snooping DB and see whether the source IP matches the entry in snooping DB on that interface. If not, drop.
if want to check source MAC along with source IP, it will need to combine IPSG + port security
Thank you very much for your time and help,