Table of Contents
Advertisement
Chapter 18
Configuring DHCP Features and IP Source Guard
In the port field of the circuit ID suboption, the port numbers start at 3. For example, on a switch with
24 10/100 ports and small form-factor pluggable (SFP) module slots, port 3 is the Fast Ethernet 0/1 port,
port 4 is the Fast Ethernet 0/2 port, and so forth. Port 27 is the SFP module slot 0/1, and so forth.
Figure 18-2
switch uses the packet formats when DHCP snooping is globally enabled and when the ip dhcp
snooping information option global configuration command is entered.
Figure 18-2
Circuit ID Suboption Frame Format
Suboption
type
1 byte
Remote ID Suboption Frame Format
Suboption
type
1 byte
DHCP Snooping Binding Database
When DHCP snooping is enabled, the switch uses the DHCP snooping binding database to store
information about untrusted interfaces. The database can have up to 8192 bindings.
Each database entry (binding) has an IP address, an associated MAC address, the lease time (in
hexadecimal format), the interface to which the binding applies, and the VLAN to which the interface
belongs. At the end of each entry is a checksum value that accounts for all the bytes associated with the
entry. Each entry is 72 bytes, followed by a space and then the checksum value.
To keep the bindings when the switch reloads, you must use the DHCP snooping database agent. If the
agent is disabled, dynamic ARP inspection or IP source guard is enabled, and the DHCP snooping
binding database has dynamic bindings, the switch loses its connectivity. If the agent is disabled and only
DHCP snooping is enabled, the switch does not lose its connectivity, but DHCP snooping might not
prevent DHCPP spoofing attacks.
The database agent stores the bindings in a file at a configured location. When reloading, the switch
reads the binding file to build the DHCP snooping binding database. The switch keeps the file current
by updating it when the database changes.
When a switch learns of new bindings or when it loses bindings, the switch immediately updates the
entries in the database. The switch also updates the entries in the binding file. The frequency at which
the file is updated is based on a configurable delay, and the updates are batched. If the file is not updated
in a specified time (set by the write-delay and abort-timeout values), the update stops.
78-17058-01
shows the packet formats for the remote ID suboption and the circuit ID suboption. The
Suboption Packet Formats
Circuit
ID type
Length
Length
1
6
0
4
1 byte 1 byte 1 byte
Remote
ID type
Length
Length
2
8
0
6
1 byte 1 byte 1 byte
VLAN
Module Port
2 bytes
1 byte 1 byte
MAC address
6 bytes
Cisco ME 3400 Ethernet Access Switch Software Configuration Guide
Understanding DHCP Features
18-5
Hide quick links:
Advertisement
Table of Contents
Troubleshooting
