DHCP snooping verify question

[Andy White]

Helo,

I'm just conencted to a switch and it has DHCP snooping, which I've configured before, here is the config:

ip dhcp snooping vlan 1

no ip dhcp snooping information option

no ip dhcp snooping verify mac

ip dhcp snooping

What I dont understand it what the command "no ip dhcp snooping verify mac" is on there for?

Why woul we use this?

Thanks

[Reza Sharifi]

Hi,

Form the config guide:

You can enable or disable DHCP snooping MAC  address verification. If the device receives a packet on an untrusted  interface and the source MAC address and the DHCP client hardware  address do not match, address verification causes the device to drop the  packet.

http://www.cisco.com/en/US/docs/switches/datacenter/sw/4_1/nx-os/security/configuration/guide/sec_dhcpsnoop.html#wp1102732

HTH

[Andy White]

What is the default?

[Reza Sharifi]

By default, it is enabled.

so,

no ip dhcp snooping verify mac

will disable it.

HTH

[Andy White]

So having it turned off what verification is it doing, it seems to me it's as if it is turned off with that command as it isn't verifying the source mac address against the DHCP snooping database?