dhcp snooping

HI,

If dhcp snooping is turned on and the rate limit is 10 packets per second then what counts as a packet? ACK, INFORM, REQUEST, OFFER, DISCOVER?

Is there some kind of official description for this by any chance?

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

wastedtime

I was kinda curious about that too. This document sums it up for me anyways. From what I get from it is all DHCP packets that go to the server are counted.

http://www9.cisco.com/en/US/docs/switches/lan/catalyst4500/12.1/12ew/configuration/guide/dhcp.pdf

creamy_stew

wastedtime wrote: »

I was kinda curious about that too. This document sums it up for me anyways. From what I get from it is all DHCP packets that go to the server are counted.

http://www9.cisco.com/en/US/docs/switches/lan/catalyst4500/12.1/12ew/configuration/guide/dhcp.pdf

The way I understand it, all DHCP packets originating from behind a DHCP-SNOOPING untrusted port count towards the rate-limit. I can't find any hard evidence for this claim, though