DHCP snooping
termnetworkingsecurity
A switch feature that only allows address-assignment replies from ports you have declared trustworthy.
It exists because the assignment protocol has no authentication: any device on the segment can answer, and the fastest answer wins. A rogue server hands out its own address as the gateway and quietly becomes the path for everything, which is a machine-in-the-middle achieved without touching a single cable in the datacentre. Marking the uplink as the only trusted port removes the whole class, and the table it builds is what several other protections then use to validate addresses.
Also known as: trusted port