show ip dhcp snooping binding
Verify DHCP snooping has learned client bindings and troubleshoot DAI or IP Source Guard failures where valid traffic is being dropped.
Definition: show ip dhcp snooping binding is a Cisco IOS privileged exec command. Displays the DHCP snooping binding table showing MAC address to IP address mappings, the VLAN, lease time, and the port each binding is associated with. Used by Dynamic ARP Inspection and IP Source Guard as a trusted source.
Overview
The `show ip dhcp snooping binding` command is a critical diagnostic tool for network engineers managing DHCP snooping, a security feature that prevents rogue DHCP servers from assigning malicious IP addresses. DHCP snooping works by building a binding database that maps each client’s MAC address to its leased IP address, VLAN, and the switch port where the client is connected. This database is populated when a DHCP client successfully obtains an IP address from a trusted DHCP server, and it is used to filter DHCP messages and prevent spoofing attacks.
The command displays the current contents of this binding table, allowing engineers to verify which clients have been granted leases, check for unauthorized devices, and ensure that DHCP snooping is functioning correctly. It is particularly useful in environments where DHCP snooping is enabled on access switches to protect against DHCP starvation and man-in-the-middle attacks. Engineers reach for this command when troubleshooting connectivity issues related to DHCP, such as clients failing to obtain IP addresses or receiving incorrect addresses, or when investigating security incidents involving rogue DHCP servers.
Alternatives include `show ip dhcp snooping` to view global snooping status and statistics, and `debug ip dhcp snooping` for real-time packet analysis, but the binding command provides a static snapshot of active leases. In the broader workflow, this command is typically used after configuring DHCP snooping on VLANs and interfaces, and it helps validate that the feature is learning bindings correctly. It is also useful when correlating with `show ip dhcp snooping statistics` to identify dropped packets.
The output is buffered and may be truncated if many bindings exist; using `show ip dhcp snooping binding | begin` or `| include` can help filter results. The command requires privileged EXEC mode (enable) and does not modify the running configuration. It is available in IOS 12.2(25)SG and later, and is a staple for CCNA and CCNP candidates studying network security and DHCP operations.
show ip dhcp snooping binding [ip-address | mac-address | vlan vlan-id | interface interface-id]When to Use This Command
- Verify a client received a DHCP address and that snooping recorded the binding
- Troubleshoot DAI dropping legitimate ARP traffic — the binding must exist for ARP to be permitted
- Confirm IP Source Guard is populated with correct MAC-IP-port bindings
- Identify stale bindings after a client moved to a different port
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| vlan | <1-4094> | Filters the binding table to show only entries for a specific VLAN. Valid values are VLAN IDs from 1 to 4094. Common mistake: using a VLAN that does not have DHCP snooping enabled, which results in no output. |
| interface | interface-type interface-number | Displays bindings learned on a specific interface, such as GigabitEthernet0/1. Use this to isolate bindings on a particular port. Common mistake: omitting the interface type or number incorrectly (e.g., 'G0/1' instead of 'GigabitEthernet0/1'). |
| ip | A.B.C.D | Shows the binding for a specific IP address. Useful for verifying a single client's lease. Common mistake: entering an IP address that is not in the binding table, which returns no output. |
| mac | H.H.H | Displays the binding for a specific MAC address in dotted-hexadecimal format (e.g., aaaa.bbbb.cccc). Common mistake: using colon or hyphen notation instead of the required three-dotted-group format. |
Command Examples
View snooping binding table
Switch# show ip dhcp snooping binding MacAddress IpAddress Lease(sec) Type VLAN Interface ------------------ --------------- ---------- ------ ---- -------------------- 00:0c:29:ab:56:78 192.168.10.101 85120 dhcp-snooping 10 GigabitEthernet1/0/1 00:0c:29:cd:90:12 192.168.10.102 85043 dhcp-snooping 10 GigabitEthernet1/0/2
Understanding the Output
Each row: MAC address of client, leased IP, remaining lease time in seconds, binding type (dhcp-snooping = learned dynamically, static = manually configured), VLAN, and switch port. If a client's binding is missing after it received a DHCP address, check that the port is untrusted and DHCP snooping is enabled on that VLAN.
Configuration Scenarios
Verify DHCP Snooping Bindings on an Access Switch
A network administrator has enabled DHCP snooping on a switch to prevent rogue DHCP servers. After clients obtain IP addresses, the admin needs to verify that the binding table is populated correctly.
Topology
Switch1(Gi0/1)---Client1
Switch1(Gi0/2)---Client2
Switch1(Gi0/24)---DHCP Server (10.0.0.1)Steps
- 1.Step 1: Enter privileged EXEC mode: Switch> enable
- 2.Step 2: Display all DHCP snooping bindings: Switch# show ip dhcp snooping binding
- 3.Step 3: Filter bindings for a specific VLAN: Switch# show ip dhcp snooping binding vlan 10
- 4.Step 4: Check bindings on a specific interface: Switch# show ip dhcp snooping binding interface GigabitEthernet0/1
! DHCP snooping configuration on Switch1 ip dhcp snooping ip dhcp snooping vlan 10 interface GigabitEthernet0/24 ip dhcp snooping trust !
Verify: Switch# show ip dhcp snooping binding MacAddress IpAddress Lease(sec) Type VLAN Interface ------------------ --------------- ---------- ------------- ---- -------------------- 00:11:22:33:44:55 192.168.10.10 86300 dhcp-snooping 10 GigabitEthernet0/1 AA:BB:CC:DD:EE:FF 192.168.10.11 86300 dhcp-snooping 10 GigabitEthernet0/2
Watch out: Ensure that the DHCP server interface is configured as trusted; otherwise, the server's DHCPOFFER messages will be dropped and no bindings will be created.
Troubleshoot a Client Not Receiving an IP Address
A user reports that their PC cannot obtain an IP address via DHCP. The switch has DHCP snooping enabled, and the admin suspects the binding table may be full or the client's MAC is not being learned.
Topology
Switch2(Gi0/5)---ClientPC (MAC: 1111.2222.3333)
Switch2(Gi0/24)---DHCP Server (192.168.1.1)Steps
- 1.Step 1: Check if the client's MAC appears in the binding table: Switch# show ip dhcp snooping binding | include 1111.2222.3333
- 2.Step 2: If no output, verify DHCP snooping is enabled on the client's VLAN: Switch# show ip dhcp snooping
- 3.Step 3: Check if the client's interface is trusted or untrusted: Switch# show ip dhcp snooping interface GigabitEthernet0/5
- 4.Step 4: Examine DHCP snooping statistics for dropped packets: Switch# show ip dhcp snooping statistics
! DHCP snooping configuration on Switch2 ip dhcp snooping ip dhcp snooping vlan 1,10,20 interface GigabitEthernet0/24 ip dhcp snooping trust !
Verify: Switch# show ip dhcp snooping binding | include 1111.2222.3333 (no output indicates the client has not obtained a lease) Switch# show ip dhcp snooping Switch DHCP snooping is enabled DHCP snooping is configured on following VLANs: 1,10,20 ... Switch# show ip dhcp snooping statistics ... Packets dropped by DHCP snooping: 5 ...
Watch out: If the client's interface is configured as trusted, DHCP snooping will not filter DHCP server messages from that port, which could allow a rogue server. Ensure only uplinks to legitimate DHCP servers are trusted.
Troubleshooting with This Command
When using `show ip dhcp snooping binding` for troubleshooting, healthy output shows a list of MAC addresses with corresponding IP addresses, lease durations, and interfaces. Each entry should have a lease time remaining (in seconds) and a type of 'dhcp-snooping'. If the table is empty, DHCP snooping may not be enabled on the client's VLAN, or the DHCP server interface is not trusted, causing all DHCPOFFER messages to be dropped.
Focus on the 'Type' field: if it shows 'static', the binding was manually configured, which may indicate a misconfiguration. Also check the 'Lease(sec)' column; if it is very low (e.g., 0), the lease may be expiring or the client may have released the IP. Common symptoms this command helps diagnose include: clients unable to obtain IP addresses (empty binding for that MAC), duplicate IP assignments (same IP with different MACs), or unauthorized devices (unexpected MACs).
A step-by-step diagnostic flow: 1) Verify DHCP snooping is globally enabled and on the correct VLANs with `show ip dhcp snooping`. 2) Check the binding table for the client's MAC. 3) If missing, check the interface trust state with `show ip dhcp snooping interface`. 4) Review DHCP snooping statistics with `show ip dhcp snooping statistics` for dropped packets. 5) Use `debug ip dhcp snooping` to see real-time DHCP packet processing (caution: can be CPU-intensive). Correlate with `show ip dhcp server statistics` on the DHCP server to confirm the server is sending replies. Also, compare with `show mac address-table` to ensure the client's MAC is learned on the expected interface.
If the binding table shows an IP address but the client cannot communicate, check for IP address conflicts using `show ip arp` or `ping` from the switch. Remember that the binding table is stored in RAM and is lost on reload unless DHCP snooping database agent is configured to store it in flash or on a TFTP server.
CCNA Exam Tips
CCNA exam: DHCP snooping must be enabled globally AND per-VLAN for bindings to populate
The binding table is used by DAI (Dynamic ARP Inspection) to validate ARP packets — if a client's IP/MAC is not in the binding table, DAI drops its ARP replies
Static DHCP assignments (ip source binding) must be manually added to the snooping table
Common Mistakes
Enabling DHCP snooping globally but forgetting ip dhcp snooping vlan <id> — bindings do not populate
Not understanding that the binding table is per-switch (not shared via VTP)
Expecting static hosts (no DHCP) to have snooping bindings — they do not; add static entries or use permit ARP ACLs for DAI
show ip dhcp snooping binding vs ip dhcp snooping limit rate
These two commands are commonly considered together because both are part of DHCP snooping: one displays the learned bindings, while the other limits the rate of DHCP packets on a port to prevent attacks. They serve different roles in the same security feature.
| Aspect | show ip dhcp snooping binding | ip dhcp snooping limit rate |
|---|---|---|
| Scope | Entire DHCP snooping binding table (global) | Individual interface (port) |
| Configuration mode | Privileged EXEC | Interface configuration |
| Persistence | Transient display of current state | Persistent configuration until removed |
| Precedence | Verification and troubleshooting | Proactive protection against attacks |
Use show ip dhcp snooping binding when you need to verify the current IP-to-MAC address bindings learned by DHCP snooping.
Use ip dhcp snooping limit rate when you need to protect a switch port from DHCP starvation or rogue server attacks by limiting the rate of incoming DHCP packets.
Platform Notes
In IOS-XE (e.g., Catalyst 3650/3850), the command syntax and output are identical to classic IOS. However, on IOS-XE, the binding table may also be viewed via `show ip dhcp snooping binding detail` for more granular information. On NX-OS (e.g., Nexus 9000), the equivalent command is `show ip dhcp snooping binding` with similar output, but note that NX-OS uses a different configuration model (e.g., `feature dhcp` must be enabled).
On ASA firewalls, DHCP snooping is not supported; instead, use `show dhcpd binding` for DHCP server bindings. In IOS-XR, DHCP snooping is not available; the closest command is `show dhcp ipv4 snooping binding` but only in specific line cards. Differences between IOS versions: In IOS 12.x, the output includes a 'Type' column that may show 'dhcp-snooping' or 'static'; in 15.x and later, the output format is consistent.
Some older IOS versions may not support the `vlan`, `interface`, `ip`, or `mac` filters; these were introduced in 12.2(52)SE and later. Always check the specific IOS documentation for your platform.
Related Commands
ip dhcp snooping limit rate
Limits the rate of DHCP packets that can be received on a switch port. Ports exceeding the rate limit are err-disabled automatically, protecting against DHCP starvation attacks and rogue DHCP servers.
spanning-tree portfast
Bypasses the STP Listening and Learning states on a port, moving it directly to Forwarding after the link comes up. Eliminates the default 30-second STP convergence delay for ports connected to end hosts.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions