How DHCPv6 Snooping Works

When enabled on a VLAN, DHCPv6 snooping stands between untrusted ports (those connected to host ports) and trusted ports (those connected to DHCPv6 servers). A VLAN with DHCPv6 snooping enabled forwards DHCPv6 request packets from clients and discards DHCPv6 server reply packets on untrusted ports. The VLAN forwards DHCPv6 server reply packets on trusted ports to DHCPv6 clients, as shown in the following figures.

DHCPv6 Snooping at Work on an Untrusted Port

DHCPv6 Snooping at Work on a Trusted Port

Note: Trusted client ports can lead to DHCPv6 starvation and spoofing attacks. When DHCPv6 snooping is enabled, DHCPv6 request packets received on trusted ports are dropped.

In this section:

  1. DHCPv6 Binding Database
Parent topic: DHCPv6 Snooping