Displaying Dhcp Snooping Information; Understanding Ip Source Guard - Cisco Catalyst 2928 Software Configuration Manual

Chapter 19 Configuring DHCP Features and IP Source Guard Features
Command
Step 7
show ip dhcp snooping database
[detail]
Step 8
copy running-config startup-config
To stop using the database agent and binding files, use the no ip dhcp snooping database global
configuration command. To reset the timeout or delay values, use the ip dhcp snooping database
timeout seconds or the ip dhcp snooping database write-delay seconds global configuration
command.
To clear the statistics of the DHCP snooping binding database agent, use the clear ip dhcp snooping
database statistics privileged EXEC command. To renew the database, use the renew ip dhcp snooping
database privileged EXEC command.
To delete binding entries from the DHCP snooping binding database, use the no ip dhcp snooping
binding mac-address vlan vlan-id ip-address interface interface-id privileged EXEC command. Enter
this command for each entry that you want to delete.

Displaying DHCP Snooping Information

To display the DHCP snooping information, use the privileged EXEC commands in
Table 19-2 Commands for Displaying DHCP Information
Command
show ip dhcp snooping
show ip dhcp snooping binding
show ip dhcp snooping database
show ip dhcp snooping statistics
If DHCP snooping is enabled and an interface changes to the down state, the switch does not delete the
Note
statically configured bindings.

Understanding IP Source Guard

IPSG is a security feature that restricts IP traffic on nonrouted, Layer 2 interfaces by filtering traffic
based on the DHCP snooping binding database and on manually configured IP source bindings. You can
use IP source guard to prevent traffic attacks if a host tries to use the IP address of its neighbor.
You can enable IP source guard when DHCP snooping is enabled on an untrusted interface. After IPSG
is enabled on an interface, the switch blocks all IP traffic received on the interface except for DHCP
packets allowed by DHCP snooping. A port access control list (ACL) is applied to the interface. The port
ACL allows only IP traffic with a source IP address in the IP source binding table and denies all other
traffic.
OL-23389-01
Purpose
Display the status and statistics of the DHCP snooping binding database
agent.
(Optional) Save your entries in the configuration file.
Purpose
Displays the DHCP snooping configuration for a switch
Displays only the dynamically configured bindings in the DHCP snooping binding
database, also referred to as a binding table.
Displays the DHCP snooping binding database status and statistics.
Displays the DHCP snooping statistics in summary or detail form.
Displaying DHCP Snooping Information
Catalyst 2928 Switch Software Configuration Guide
Table 19-2:
19-13