Which Layer 2 Filter Drops It?

About this interactive

From the lessons, the four Layer 2 filters: - **Port security:** counts and checks MAC addresses on a port. - **DHCP snooping:** inspects DHCP messages, drops server messages on untrusted ports, and builds the binding table (IP, MAC, port). - **Dynamic ARP inspection:** inspects ARP messages against that binding table. - **IP source guard:** inspects ordinary IP traffic against that binding table, so a host can only send from the address (and, optionally, the MAC) it leased on that port. It stops IP address spoofing.

What you'll learn

Choose the Layer 2 security feature that drops a frame: port security for too many MACs, DHCP snooping for bad DHCP messages, dynamic ARP inspection for forged ARP, IP source guard for spoofed IP source addresses
Explain how DHCP snooping's binding table underpins both dynamic ARP inspection and IP source guard

Aligned to

Cisco CCNA

5.7 Configure and verify Layer 2 security features

Key terms

IP Source Guard: A Layer 2 security feature on switches that filters traffic by validating source IP and MAC addresses against the DHCP snooping binding database to prevent IP and MAC address spoofing.
Port Security: A Cisco switch feature that restricts which devices can connect to a port by limiting the number of allowed MAC addresses or requiring specific MAC addresses to be present. When a violation occurs, the port can be configured to shut down, restrict traffic, or send an alert.
DHCP Snooping: A switch security feature that classifies ports as trusted (connected to legitimate DHCP servers) or untrusted (connected to end devices) and drops DHCP server responses received on untrusted ports. It builds a binding database of valid IP-to-MAC-to-port mappings used by other Layer 2 security features like Dynamic ARP Inspection.
Dynamic ARP Inspection: A security feature on managed switches that validates ARP messages against the DHCP snooping binding database, dropping packets with invalid IP-to-MAC address mappings.
DHCP Snooping Binding Database: A table maintained by DHCP snooping that records IP address, MAC address, and port mappings to validate DHCP messages and detect illegitimate requests.
MAC Address Flooding: An attack in which an attacker overwhelms a switch's MAC address table with spoofed addresses, causing the switch to behave like a hub and broadcast traffic to all ports.

Topics

Ip Source Guard Port Security Dhcp Snooping Dynamic Arp Inspection Layer 2 Security Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →