41-4
When receiving a DHCP client’s request without Option 82, the DHCP snooping device will add the
option field with the configured sub-option and then forward the packet. For details, see
Table 41-2
.
Table 41-2
Ways of handling a DHCP packet without Option 82
Sub-option configuration
The DHCP-Snooping device will …
Neither of the two sub-options is
nfigured.
The format of Option 82 is the one specified with the
dhcp-snooping information format
command or the default
HEX format if this command is not executed.
co
th the default
Forward the packet after adding Option 82 wi
contents.
Circuit ID sub-option is configured.
circuit ID sub-option in ASCII format.
Forward the packet after adding Option 82 with the configured
Re
remote ID sub-option in ASCII format.
mote ID sub-option is configured.
Forward the packet after adding Option 82 with the configured
The circuit ID and remote ID sub-options in Option 82, which can be configured simultaneously or
separately, are indep
ent of each othe
sequence.
end
r in terms of configuration
When the DHCP snooping device receives a DHCP response packet from the DHCP server, the DHCP
s
the Opt
ined, before for
forward the packet if the packet does not contain the Option 82 field.
Introduction to IP Filtering
A
ans an attempt of an attacker s
f forged
a
sts with different so
e server
normally. The specific effects are as follows:
The resources on the server are exhausted, so the server does not respond to other requests.
z
After receiving such type of packets, a switch needs to send them to the CPU for processing. Too
many request packets cause high CPU usage rate. As a result, the CPU cannot work normally.
The switch can filter invalid IP packets through the DHCP-snooping table and , IP static binding table, or
IP-to-MAC mappings of authenticated 802.1x clients.
DHCP-snooping table
After DHCP snooping is enabled on a switch, a DHCP-snooping table is generated. It is used to record
IP addresses obtained from the DHCP server, MAC addresses, the number of the port through which a
client is connected to the DHCP-snooping-enabled device, and the number of the VLAN to which the
port belongs to. These records are saved as entries in the DHCP-snooping table.
IP static binding table
The DHCP-snooping table only records information about clients that obtains IP address dynamically
through DHCP. If a fixed IP address is configured for a client, the IP address and MAC address of the
nooping device will delete
ion 82 field, if conta
warding the packet, or will directly
denial-of-service (DoS) attack me
ddress reque
ending a large number o
so that the network cannot work
urce IP addresses to th
z
