nuLAB.ai
Start free trial

IP Source Guard

How a switch filters IPv4 traffic based on the source binding allowed on its ingress port.

Apply the binding to data packets

IP Source Guard checks the source of IPv4 data traffic entering a protected Layer 2 port. On supported platforms, it uses DHCP snooping bindings or manually configured source bindings. Depending on the mode, it can check the source IP alone or also require the expected source MAC.

DAI checks the claims made by ARP messages. IP Source Guard checks the source in traffic after address resolution. A valid ARP exchange alone does not authorize a host to send IPv4 data using another client’s address.

Try it in a lab

  1. Verify that a lab client with a valid DHCP snooping binding can reach a test peer through the guarded port.
  2. Using the same test port, send traffic with an unbound IPv4 source. Check that it is dropped, then restore the assigned address and verify that the permitted traffic still passes.

Sources