Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible in a managed switch such as a 3com 4500 or a HP Baseline PWR-Plus type switch to block DHCP from being served through specific ports, or all except 1 port?

I have a DHCP server for example plugged in to port 1, I need that to continue working, but I want to prevent the issue where a user plugs in a rogue device (router) that serves up dhcp.

When this happens, some percentage of the time, the clients will now get dhcp from this rogue device, which is not the correct ip range, so clients loose connectivity.

I am wondering if there is some kind of setting in the switches, or some other approach?

share|improve this question

Many manufactures of switches offer options on their managed equipment to handle this. Cisco, for example, has "DHCP snooping" that will determine where DHCP messages can come from and "IP Source Guard" that will also prevent traffic from using an IP they didn't obtain from the DHCP server. See

HP also does DHCP snooping:

... and the remaining vendors of interest will be an exercise for the reader.

share|improve this answer

You switches allow you to filter IP ports. So you just have to block port UDP 67 (DHCP DISCOVER) or UDP 68 (DHCP OFFER) (depend if you want to block input or output, or maybe both) except on the desired switch port.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.