Tutorials · Security
How to Stop Rogue DHCP Servers and ARP Spoofing
Protect users from fake gateways and man-in-the-middle attacks with DHCP snooping and dynamic ARP inspection.
Before you start
- Managed switches with DHCP snooping support (check the datasheet)
Step by step
Enable DHCP snooping per VLAN
ip dhcp snooping ip dhcp snooping vlan 10,40
Trust the real DHCP path
Mark uplinks towards the legitimate DHCP server as trusted; all other ports are untrusted.
interface tengigabitEthernet 0/1 ip dhcp snooping trust
Enable dynamic ARP inspection
The switch drops ARP replies that do not match the DHCP binding table.
ip arp inspection vlan 10,40Handle static devices
Add static bindings or ARP ACLs for servers and printers with fixed IPs.
Verify
show ip dhcp snooping binding show ip arp inspection
Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.
Pro tips
- Rate-limit DHCP on untrusted ports.
- Enable these features on guest and user VLANs first.
FAQ
Frequently asked questions
What is a rogue DHCP server?
Any device handing out addresses that you did not authorise, often a home router plugged into the office network.
Keep learning
Related guides
802.1X port authentication
Read more →How to Enable 802.1X Port Authentication on Switches
Stop unknown devices from using your network ports: configure 802.1X with RADIUS and MAC-authentication bypass for printers and cameras.
Read more →How to Secure the Management of Switches, Routers and Access Points
A hardening checklist for every network device: strong credentials, SSH only, a management VLAN, access lists and logging.
Read more →How to Segment IoT and CCTV Devices From Your Main Network
Put cameras, smart TVs, sensors and building systems in their own VLANs so one compromised device cannot reach your business systems.
Read more →Stuck on a step?
Ask Navijin technical support or an authorised partner for help with your configuration.