Now that we have DHCP snooping on the latest release candidate it would be really nice to have have IP source guard and dynamic arp inspection. So a user cannot use another IP address than provided by DHCP.

Now that we have DHCP snooping on the latest release candidate it would be really nice to have have IP source guard and dynamic arp inspection. So a user cannot use another IP address than provided by DHCP.

But what does DHCP Snooping do in RC? I thought it should do exactly that

• This is also available in Cisco-land as ip source verify and is applied at the interface level.
• Like others have said here, while DHCP snooping is a great step forward in expanding the MT security toolset, that feature is very narrow in terms of the security it provides.
• The more salient issue is when an attacker knows the client IP address. Neither DHCP snooping or read-only ARP are able to prevent such a spoof whereas as ip source verify can.
• It is almost certain that implementing source verify requires DHCP snooping as the latter's database is typically what is queried to determine if a packet with a given SA is allowed through.
• It is also important to provide the ability to add static IP-to-MAC mappings so that trusted sources w/ static IPs are allowed through. The command in Cisco-land is:
  --- ip source binding [ MAC_ADDRESS ] vlan [ VLAN_ID (optional) ] [ IP_ADDRESS ] interface [ INGRESS_INTERFACE ]
• I definitely vote in favor of implementing this very important security feature.