Cisco Catalyst 3560X-24P Command Reference Manual page 648

show ip dhcp snooping statistics
Table 2-36
Table 2-36
DHCP Snooping Statistic
Packets Processed by DHCP Snooping
Packets Dropped Because IDB not known Number of errors when the input interface of the packet
Queue full
Interface is in errdisabled
Rate limit exceeded
Received on untrusted ports
Nonzero giaddr
Source mac not equal to chaddr
Binding mismatch
Insertion of opt82 fail
Catalyst 3750-X and 3560-X Switch Command Reference
2-616
shows the DHCP snooping statistics and their descriptions:
DHCP Snooping Statistics
Chapter 2 Catalyst 3750-X and 3560-X Cisco IOS Commands
Description
Total number of packets handled by DHCP snooping,
including forwarded and dropped packets.
cannot be determined.
Number of errors when an internal queue used to process
the packets is full. This might happen if DHCP packets are
received at an excessively high rate and rate limiting is not
enabled on the ingress ports.
Number of times a packet was received on a port that has
been marked as error disabled. This might happen if
packets are in the processing queue when a port is put into
the error-disabled state and those packets are subsequently
processed.
Number of times the rate limit configured on the port was
exceeded and the interface was put into the error-disabled
state.
Number of times a DHCP server packet (OFFER, ACK,
NAK, or LEASEQUERY) was received on an untrusted
port and was dropped.
Number of times the relay agent address field (giaddr) in
the DHCP packet received on an untrusted port was not
zero, or the no ip dhcp snooping information option
allow-untrusted global configuration command is not
configured and a packet received on an untrusted port
contained option-82 data.
Number of times the client MAC address field of the
DHCP packet (chaddr) does not match the packet source
MAC address and the ip dhcp snooping verify
mac-address global configuration command is
configured.
Number of times a RELEASE or DECLINE packet was
received on a port that is different than the port in the
binding for that MAC address-VLAN pair. This indicates
someone might be trying to spoof the real client, or it could
mean that the client has moved to another port on the
switch and issued a RELEASE or DECLINE. The MAC
address is taken from the chaddr field of the DHCP packet,
not the source MAC address in the Ethernet header.
Number of times the option-82 insertion into a packet
failed. The insertion might fail if the packet with the
option-82 data exceeds the size of a single physical packet
on the internet.
OL-21522-02