Layer 2 Attack Mitigation
Security
Overview
DHCP snooping distinguishes trusted server ports and builds bindings; Dynamic ARP Inspection validates ARP where configured; port security limits accepted MAC behavior. Incorrect trust settings can block legitimate traffic. These controls supplement segmentation and monitoring rather than replace them.
Protocol stages
- 1DHCP binding
- 2Port trust
- 3ARP validation
- 4Drop / forward
Interactive exercise
Knowledge check
An untrusted edge port sends a forged DHCP server offer. With snooping enabled correctly, what happens?
Educational model — not real hardware, traffic or official certification.