Chapter 8: DHCP Snooping and ARP Inspection

ip dhcp snooping

Global command that enables DHCP Snooping on the switch, allowing it to inspect and validate DHCP messages across all VLANs.

ip dhcp snooping vlan 10,20

Global command that enables DHCP Snooping on VLANs 10 and 20, assuming DHCP Snooping is globally enabled.

ip dhcp snooping information option

Global command that configures the switch to insert DHCP Option 82 information into DHCP packets when using DHCP Snooping.

no ip dhcp snooping information option

Global command that disables the insertion of DHCP Option 82 information in DHCP packets.

ip dhcp snooping trust GigabitEthernet1/0/5

Interface subcommand that marks GigabitEthernet1/0/5 as trusted for DHCP Snooping, allowing all DHCP messages on that port.

no ip dhcp snooping trust GigabitEthernet1/0/6

Interface subcommand that marks GigabitEthernet1/0/6 as untrusted for DHCP Snooping, causing unauthorized DHCP messages to be dropped.

ip dhcp snooping limit rate 5

Interface subcommand that limits DHCP Snooping to process a maximum of 5 DHCP messages per second on the interface before discarding excess messages.

errdisable recovery cause dhcp-rate-limit

Global command that enables automatic recovery of interfaces err-disabled due to exceeding the DHCP rate limit.

errdisable recovery cause arp-inspection

Global command that enables automatic recovery of interfaces err-disabled due to Dynamic ARP Inspection violations.

errdisable recovery interval 30

Global command that sets the recovery delay to 30 seconds before automatically recovering any err-disabled interface.

show ip dhcp snooping

EXEC command that displays the current DHCP Snooping configuration settings on the switch.

show ip dhcp snooping statistics

EXEC command that shows counters related to DHCP Snooping behavior, including allowed and dropped DHCP messages.

show ip dhcp snooping binding

EXEC command that displays the DHCP Snooping binding table, listing MAC-to-IP address mappings per VLAN and interface.

show ip arp inspection

EXEC command that displays Dynamic ARP Inspection configuration settings and packet counters.

show ip arp inspection statistics

EXEC command that shows counters for ARP inspection, including the number of inspected and dropped ARP packets.