Your switch is handing out IP addresses right now.

One of those responses might not be from your DHCP server.

A rogue DHCP server needs no exploit. It just needs to reply faster than yours.

What DHCP does: When a device connects, it broadcasts a DHCPDISCOVER. Any server on the segment can respond. The client accepts the first offer — IP address, default gateway, DNS server. All of it, unconditionally.

That is the problem.

How the attack works

• ROGUE DHCP SERVER An attacker runs a rogue DHCP service on any connected device. If it responds first, the client receives attacker-controlled configuration — default gateway pointing to the attacker's machine. Every packet routes through them. Full man-in-the-middle, zero alerts, invisible to the user.
• IP EXHAUSTION Attackers also drain your legitimate DHCP pool using spoofed MAC floods, exhausting the entire lease range. Clients stop receiving addresses. The rogue server fills the vacuum.

What DHCP Snooping does: DHCP Snooping is a Layer 2 security feature built into enterprise switches. It classifies every port as trusted or untrusted.

TRUSTED PORTS — Uplinks to legitimate DHCP servers, inter-switch links, router interfaces. Server responses are permitted.

UNTRUSTED PORTS — All access ports where end devices connect. DHCPOFFER and DHCPACK packets are silently dropped. No client receives a rogue assignment.

• THE BINDING TABLE Every successful DHCP exchange on an untrusted port generates a binding entry: MAC address, IP address, VLAN, port, lease duration. This table is active enforcement, not passive logging.

Dynamic ARP Inspection and IP Source Guard both rely on it to prevent ARP spoofing and IP spoofing segment-wide. DHCP Snooping is the foundation both controls require.

Real consequences: In 2024, a logistics company sustained a six-week MITM campaign on its warehouse floor network. An unauthorized router with an active DHCP service had been connected. Sixty-four devices received attacker-controlled gateway assignments. Credentials and ERP session tokens were intercepted for 42 days. DHCP Snooping was not enabled on access switches.

How to defend

• ENABLE DHCP SNOOPING PER VLAN Apply it per VLAN. Do not rely on defaults.

TRUST ONLY UPLINK PORTS — One misclassified port as trusted removes all downstream protection.

PERSIST THE BINDING TABLE — Write it to flash or a TFTP server. A reboot without it creates a re-exposure window.

RATE-LIMIT UNTRUSTED PORTS — Cap DHCP traffic to 10–15 packets per second per port to absorb exhaustion attempts.

MONITOR SNOOPING VIOLATIONS — Drops are logged. Violations on an access port mean something is acting as a DHCP server.

DHCP Snooping costs nothing to configure. The attack costs nothing to launch.

Which side of that equation are you on?