DHCPsuojaus

DHCPsuojaus, often translated as DHCP Guard or DHCP Snooping, is a security feature implemented on network switches. Its primary function is to prevent rogue DHCP servers from operating on a local area network (LAN). A rogue DHCP server can maliciously assign IP addresses to clients, potentially redirecting their network traffic to unintended destinations, leading to man-in-the-middle attacks or denial-of-service conditions.

DHCPsuojaus works by classifying switch ports into two categories: trusted and untrusted. Trusted ports are typically connected to legitimate DHCP servers or upstream network devices. Untrusted ports are connected to end-user devices, such as computers or IP phones. The switch then monitors DHCP messages that pass through these ports.

When DHCPsuojaus is enabled, the switch allows DHCP server messages (like OFFER and ACK) to pass only from trusted ports. DHCP client messages (like DISCOVER and REQUEST) are generally allowed from untrusted ports. If a DHCP server message is detected on an untrusted port, the switch discards it and may log the event or even shut down the port to prevent further malicious activity. This mechanism effectively isolates legitimate DHCP services and prevents unauthorized servers from interfering with network operations. DHCPsuojaus is a crucial component of network security, especially in larger or more sensitive environments.