DHCP Snooping rate limiting restricts the DHCP messages a switch port accepts per second, reducing CPU-exhaustion and DHCP-related denial-of-service risk. section 13.2.3
Configure and interpret the feature as follows:
- Apply ip dhcp snooping limit rate rate in interface configuration mode; rate specifies packets per second (pps). section 13.2.3
- Select limits according to the port: Cisco recommends no more than 100 pps on untrusted ports, but uplinks may need higher rates than single-host ports. section 13.2.3
- Exceeding the threshold error-disables the interface; rate limiting can also be configured on trusted ports, although this is uncommon. section 13.2.3
One-packet-per-second test
SW2(config)# interface g0/2 SW2(config-if)# ip dhcp snooping limit rate 1 The switch reports that the threshold was exceeded, then places Gi0/2 in the err-disable state.
