show ip dhcp snooping
Displays the DHCP snooping binding database and statistics, used to verify DHCP snooping operation and identify rogue DHCP servers or unauthorized clients.
Definition: show ip dhcp snooping is a Cisco IOS privileged exec command. Displays the DHCP snooping binding database and statistics, used to verify DHCP snooping operation and identify rogue DHCP servers or unauthorized clients.
Overview
The 'show ip dhcp snooping' command is a critical diagnostic tool for network engineers managing switched networks with DHCP snooping enabled. DHCP snooping is a security feature that acts as a firewall between untrusted hosts and trusted DHCP servers, preventing rogue DHCP server attacks and ensuring clients receive valid IP configurations. This command displays the DHCP snooping binding database, which contains the MAC address, IP address, lease time, VLAN, and interface for each trusted DHCP client.
It also shows statistics on DHCP messages processed, dropped, and forwarded, which helps identify misconfigurations or malicious activity. Network engineers reach for this command when troubleshooting IP address assignment issues, verifying that DHCP snooping is correctly filtering unauthorized DHCP offers, or auditing the binding table for stale entries. Unlike 'show ip dhcp server statistics', which focuses on server-side operations, this command provides a switch-centric view of DHCP traffic.
It is typically used after configuring DHCP snooping globally and on specific VLANs, and before enabling Dynamic ARP Inspection (DAI) or IP Source Guard, which rely on the snooping database. The command outputs buffered data; in large networks, the binding table can be extensive, so filtering with parameters like '| include' is common. It requires privileged EXEC mode (enable) and does not modify the running configuration.
Understanding this output is essential for CCNA and CCNP candidates, as DHCP snooping is a core security feature in campus networks, and misconfiguration can lead to connectivity failures or security breaches. The command reveals whether the switch is learning bindings correctly, whether any interfaces are in an untrusted state, and whether DHCP packets are being dropped as expected. It also helps correlate with other show commands like 'show ip dhcp snooping binding' for detailed binding info, or 'debug ip dhcp snooping' for real-time packet analysis.
In summary, this command is the primary verification tool for DHCP snooping, enabling engineers to ensure network integrity and troubleshoot IP allocation problems efficiently.
show ip dhcp snoopingWhen to Use This Command
- Verify that DHCP snooping is enabled and active on VLANs after configuration.
- Check the DHCP snooping binding table to see which clients have obtained IP addresses via trusted DHCP servers.
- Troubleshoot DHCP-related connectivity issues by confirming that DHCP snooping is not blocking legitimate traffic.
- Monitor for potential rogue DHCP servers by reviewing the DHCP snooping statistics for dropped packets.
Command Examples
Basic DHCP Snooping Status and Binding Table
show ip dhcp snoopingSwitch DHCP snooping is enabled DHCP snooping is configured on following VLANs: 10,20,30 DHCP snooping is operational on following VLANs: 10,20,30 DHCP snooping is configured on the following L3 Interfaces: Insertion of option 82 is enabled Interface Trusted Rate limit (pps) ----------------------- ------- ------------------ GigabitEthernet0/1 yes unlimited GigabitEthernet0/2 no 100 GigabitEthernet0/3 no 100 DHCP snooping binding count: 5 DHCP snooping database agent: not configured MAC Address IP Address Lease(sec) Type VLAN Interface ------------------ ---------------- ---------- ------------- ---- -------------------- 00:1a:2b:3c:4d:5e 192.168.10.10 86400 dhcp-snooping 10 GigabitEthernet0/2 00:1a:2b:3c:4d:5f 192.168.10.11 86400 dhcp-snooping 10 GigabitEthernet0/2 00:1a:2b:3c:4d:60 192.168.20.20 43200 dhcp-snooping 20 GigabitEthernet0/3 00:1a:2b:3c:4d:61 192.168.20.21 43200 dhcp-snooping 20 GigabitEthernet0/3 00:1a:2b:3c:4d:62 192.168.30.30 86400 dhcp-snooping 30 GigabitEthernet0/3
Line 1: Shows global DHCP snooping status (enabled/disabled). Line 2-3: Lists VLANs where snooping is configured and operational. Line 5: Shows if option 82 insertion is enabled. Line 7-10: Interface table: 'Trusted' column indicates if interface is trusted (yes/no); 'Rate limit' shows packets per second limit (unlimited or number). Line 12: Total number of DHCP snooping bindings. Line 13: Database agent status (not configured or path). Line 15-20: Binding table: MAC address, IP address, lease time in seconds, type (dhcp-snooping), VLAN, and interface where client is connected.
DHCP Snooping Statistics
show ip dhcp snooping statisticsPackets Processed by DHCP Snooping ==================================== Packet Type Count ----------- ----- Total DHCP packets received 1500 DHCP packets dropped 10 DHCP packets forwarded 1490 Packet Drop Statistics ===================== Reason Count ------ ----- Invalid server 5 Invalid client 3 Rate limit exceeded 2 DHCP Snooping Database Agent Statistics ======================================== Agent not configured
First section: Total DHCP packets received, dropped, and forwarded. High drop count may indicate issues. Second section: Drop reasons: 'Invalid server' indicates packets from untrusted sources claiming to be DHCP servers; 'Invalid client' indicates clients with invalid MAC/IP; 'Rate limit exceeded' shows packets dropped due to rate limiting. Third section: Database agent statistics (not configured here).
Understanding the Output
The 'show ip dhcp snooping' command output is divided into several sections. The first section shows the global status (enabled/disabled) and the VLANs on which DHCP snooping is configured and operational. If a VLAN is configured but not operational, it may be because the VLAN does not exist or is not active.
The second section lists interfaces with their trusted status and rate limit. Trusted interfaces (typically uplinks to DHCP servers) should be set to 'yes'; all other interfaces should be 'no' to prevent rogue DHCP server attacks. The rate limit column shows the configured packets-per-second limit; 'unlimited' means no rate limiting.
The third section shows the binding table, which contains the MAC address, IP address, lease time, type (always 'dhcp-snooping' for dynamically learned), VLAN, and interface. A healthy network should have bindings for all legitimate DHCP clients. Missing bindings may indicate DHCP snooping is blocking legitimate traffic or the client did not complete the DHCP process.
The statistics output helps identify the number of dropped packets and the reasons, which is crucial for troubleshooting. A high number of 'Invalid server' drops suggests a rogue DHCP server is present on an untrusted interface.
Configuration Scenarios
Basic DHCP Snooping Configuration on a VLAN
A network administrator needs to enable DHCP snooping on VLAN 10 to protect against rogue DHCP servers. The trusted DHCP server is connected to interface GigabitEthernet0/1, and all other interfaces are untrusted.
Topology
Switch(S1) with Gi0/1 connected to DHCP Server (192.168.10.1), Gi0/2 connected to Client PC, VLAN 10Steps
- 1.Step 1: Enter global configuration mode: configure terminal
- 2.Step 2: Enable DHCP snooping globally: ip dhcp snooping
- 3.Step 3: Enable DHCP snooping for VLAN 10: ip dhcp snooping vlan 10
- 4.Step 4: Configure the interface connected to the DHCP server as trusted: interface GigabitEthernet0/1, then ip dhcp snooping trust
- 5.Step 5: Exit to privileged EXEC mode and verify: end, then show ip dhcp snooping
! Global DHCP snooping configuration ip dhcp snooping ip dhcp snooping vlan 10 ! ! Trusted interface for DHCP server interface GigabitEthernet0/1 ip dhcp snooping trust
Verify: Use 'show ip dhcp snooping' to verify that DHCP snooping is enabled globally and on VLAN 10, and that Gi0/1 is trusted. Expected output shows 'DHCP snooping is enabled', 'VLAN 10: DHCP snooping is enabled', and 'Interface Gi0/1 is trusted'.
Watch out: A common mistake is forgetting to enable DHCP snooping globally before enabling it on a VLAN. If global is not enabled, the VLAN command will be accepted but snooping will not function.
Troubleshooting DHCP Binding Table with Stale Entries
After a network change, some clients are unable to renew their IP addresses. The administrator suspects stale DHCP snooping bindings are causing issues and needs to inspect the binding table.
Topology
Switch(S1) with multiple clients on VLAN 20, DHCP server on Gi0/1Steps
- 1.Step 1: Display the DHCP snooping binding database: show ip dhcp snooping binding
- 2.Step 2: Check for expired or duplicate entries. Note the lease time and MAC addresses.
- 3.Step 3: If stale entries are found, clear the binding database: clear ip dhcp snooping binding
- 4.Step 4: Verify that clients can obtain new IP addresses by checking the binding table again: show ip dhcp snooping binding
- 5.Step 5: Monitor DHCP snooping statistics for dropped packets: show ip dhcp snooping statistics
! No configuration change needed; this is a troubleshooting scenario ! Use the following commands in privileged EXEC mode: show ip dhcp snooping binding clear ip dhcp snooping binding show ip dhcp snooping statistics
Verify: After clearing, the binding table should be empty. Clients should then be able to obtain new leases. Use 'show ip dhcp snooping binding' to see new entries appearing. Also check 'show ip dhcp snooping statistics' to ensure no excessive drops.
Watch out: Clearing the binding database will cause all DHCP clients to lose their IP addresses until they renew. This should be done during a maintenance window or when clients can easily re-obtain addresses.
Troubleshooting with This Command
When troubleshooting DHCP issues with DHCP snooping enabled, the 'show ip dhcp snooping' command provides a high-level overview of the feature's status and key indicators. Healthy output shows 'DHCP snooping is enabled' globally and on the relevant VLANs, with trusted interfaces correctly identified. The 'Statistics' section should show a reasonable number of DHCP packets processed, with few or no dropped packets.
If the output shows 'DHCP snooping is disabled' on a VLAN where it should be active, check the global configuration and VLAN configuration. A common problem is that DHCP snooping is enabled globally but not on the specific VLAN, or the VLAN is not in the allowed list. If the 'Trusted' column shows an interface as 'Untrusted' when it should be trusted, the 'ip dhcp snooping trust' command may be missing or misapplied.
In such cases, DHCP offers from the server will be dropped, causing clients to fail to obtain IP addresses. Another key area is the binding database. Use 'show ip dhcp snooping binding' to view individual entries.
If clients are not appearing in the binding table, it indicates that DHCP snooping is not learning their leases. This could be due to the client's VLAN not being snooped, or the DHCP packets being dropped before reaching the switch. Check the 'show ip dhcp snooping statistics' output for 'DHCP packets dropped' counters.
A high number of dropped packets on an untrusted interface may indicate a rogue DHCP server or a misconfigured client. Conversely, if packets are being dropped on a trusted interface, the server may be sending invalid packets. Correlate with 'debug ip dhcp snooping' to see real-time packet details, but use caution in production.
Also, compare with 'show ip dhcp snooping database' to see if the binding database is being written to a remote server. If the database is not updating, clients may lose bindings after a reload. In summary, a systematic approach: first verify global and VLAN status, then check interface trust states, then examine binding table and statistics.
Focus on dropped packet counters and trust mismatches. This command, combined with 'show ip dhcp snooping binding' and 'show ip dhcp snooping statistics', provides a complete picture of DHCP snooping health.
CCNA Exam Tips
Remember that DHCP snooping must be enabled globally and per VLAN; 'show ip dhcp snooping' shows both configured and operational VLANs.
Know that trusted interfaces are typically uplinks to DHCP servers; all other interfaces should be untrusted.
The binding table is built from DHCP ACK messages; if a client does not get an IP, check if the interface is untrusted and the server is on a trusted interface.
Be aware that DHCP snooping drops packets from DHCP servers on untrusted interfaces; this is a common exam scenario for security.
Common Mistakes
Forgetting to enable DHCP snooping globally with 'ip dhcp snooping' before configuring per VLAN.
Setting all interfaces as trusted, which defeats the purpose of DHCP snooping.
Not configuring a rate limit on untrusted interfaces, leaving the switch vulnerable to DHCP starvation attacks.
show ip dhcp snooping vs ip dhcp snooping
The commands 'show ip dhcp snooping' and 'ip dhcp snooping' are often confused because of their similar names, but one is a show command used to verify DHCP snooping status and statistics, while the other is a configuration command that enables the feature globally. Understanding the distinction between verification and configuration is crucial for proper network security implementation.
| Aspect | show ip dhcp snooping | ip dhcp snooping |
|---|---|---|
| Configuration mode | Privileged EXEC (show) | Global Configuration (config) |
| Primary effect | Displays binding database and statistics | Enables DHCP snooping globally |
| Persistence | Not saved; output is transient | Saved in running-config; requires 'no ip dhcp snooping' to revert |
| Typical use | Verifying DHCP snooping operation after configuration | Initial setup of DHCP snooping on the switch |
| Output | Produces detailed text output | No output; silently changes configuration |
| Precedence | Requires DHCP snooping already enabled globally | Must be executed before show commands can provide meaningful info |
Use show ip dhcp snooping when you need to inspect the DHCP snooping binding table, verify if snooping is active, or troubleshoot rogue DHCP issues.
Use ip dhcp snooping when you want to globally enable DHCP snooping on the switch to filter untrusted DHCP messages and prevent rogue DHCP server attacks.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 series), the 'show ip dhcp snooping' command syntax and output are largely identical to classic IOS. However, IOS-XE may include additional fields such as 'Information option' (Option 82) status and 'Circuit ID' format. The command is available in IOS-XE privileged EXEC mode.
For NX-OS (e.g., Nexus switches), the equivalent command is 'show ip dhcp snooping' but with different output formatting. NX-OS also uses 'ip dhcp snooping' configuration commands, but the trust interface command is 'ip dhcp snooping trust' under interface configuration. Additionally, NX-OS supports 'show ip dhcp snooping statistics' and 'show ip dhcp snooping binding'.
On ASA firewalls, DHCP snooping is not directly supported; instead, ASA uses DHCP relay and server features. The command does not exist in IOS-XR, which uses a different DHCP implementation (DHCP local server). For IOS versions, the command has been available since 12.2(25)SEA.
In 15.x and 16.x, the output may include additional details like 'DHCP snooping database agent' status. Always check the specific platform documentation for any syntax variations.
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions