Hello everyone, I would like a clarification. If on the untrusted ports I configure dhcp snooping and go on, I impose that for example on the access ports no more than 5 dhcp packets must arrive in 1 minute, so as for dhcp starvation the problem seems solved the dhcp server should not be saturated by a malicious. But in the case of dhcp spoofing, the hacker becomes a dhcp server; it is true that after the fifth dhcp request the frame will be discarded, but is it also true that in the meantime the hacker has the possibility to satisfy even a single dhcp request from a client? In fact, dhcp discover, offer, request and ack are 4 frames that pass through that port within a few seconds could even satisfy more requests, giving wrong information to someone. Is that so or am I wrong? In fact in the manuals it is not written that dhcp snooping serves to avoid a dhcp spoofing attack but to mitigate it. What do you think?
