Layer 2 attacks (CAM overflow, rogue DHCP, ARP spoofing) bypass everything above. Port Security limits which MACs may appear on a port; DHCP Snooping permits DHCP responses only from trusted ports; Dynamic ARP Inspection rejects forged ARP.
By default, a switch port accepts frames from any source MAC. Port Security restricts the count and (optionally) the specific MACs allowed. A violation can shut the port (default), restrict it (drop violators silently), or protect it (drop quietly, no logging).
Switch(config)# interface Fa0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 2
Switch(config-if)# switchport port-security mac-address sticky
Switch(config-if)# switchport port-security violation shutdownWhen a rogue DHCP server appears, hosts may receive an attacker's gateway. DHCP Snooping marks each port as trusted or untrusted; only trusted ports may send DHCP server responses (Offer, ACK). Build a binding table of (MAC, IP, VLAN, port, lease).
Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10,20
Switch(config)# interface Gi0/1
Switch(config-if)# ip dhcp snooping trust1 more section in this chapter, plus a 2-question quiz.
You can see the title, summary, learning objectives and the opening sections. The rest of this chapter, like all of modules 2–8, comes with the Course & Lab Pass and All-Access Max. A free account opens Module 1: Network Foundations end-to-end and saves your labs — start there, no card required.
NetForge-AI is an independent educational platform and is not affiliated with, endorsed by, or sponsored by any networking vendor or certification body. All product names, protocols, and standards referenced are the property of their respective owners and are used for descriptive, educational purposes only.
Free account · no card required · compare plans any time