TechKnowSurge
Cisco CCNA 5.7
TechKnowSurge Catalog Videos IP Source Guard
VideoNetworkFree

IP Source Guard

IP Source Guard protects networks against IP and MAC address spoofing by validating traffic against the DHCP snooping binding database at the switch level. It serves as an additional layer of Layer 2 security alongside port security, DHCP snooping, and Dynamic ARP inspection.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

MAC and IP address spoofing are low-skill, high-impact attack vectors. By manually assigning a specific IP address, an attacker can impersonate any device on the network — including the default gateway — redirecting traffic to cause a denial-of-service condition or positioning themselves for a man-in-the-middle attack where they can intercept and inspect network communications. Because these attacks are so straightforward to execute, layered network defenses at the switch level are essential. IP Source Guard is one of several Layer 2 filtering mechanisms designed to counter this threat directly on the switch. IP Source Guard builds on the foundation established by DHCP snooping and Dynamic ARP inspection. DHCP snooping creates a binding database that maps MAC addresses, IP addresses, and switch ports based on observed DHCP transactions. Dynamic ARP inspection uses that same database to validate ARP messages passing through the switch. IP Source Guard applies the same binding database to all IP traffic, checking whether the source IP address and optionally the source MAC address in each frame match what the binding database expects for that port. Frames that don't match are dropped before they can traverse the network. The result is a consistent, database-driven validation chain across all three controls. Where DHCP snooping filters suspicious DHCP messages and Dynamic ARP inspection validates ARP traffic, IP Source Guard extends that scrutiny to general IP frames — ensuring that any device attempting to send traffic from a spoofed address is blocked at the port level. Together, these mechanisms form a coherent Layer 2 security strategy that significantly reduces the attack surface for address-based spoofing on switched networks.

What you'll learn

What's covered

IP Source Guard

Aligned to

Cisco CCNA
5.7 Configure and verify Layer 2 security features

Key terms

IP Source Guard
A Layer 2 security feature on switches that filters traffic by validating source IP and MAC addresses against the DHCP snooping binding database to prevent IP and MAC address spoofing.
Spoofing
An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.
Dynamic Host Configuration Protocol
DHCP
A network protocol that automatically assigns IP addresses and other configuration parameters to devices on a network.
DHCP Snooping Binding Database
A table maintained by DHCP snooping that records IP address, MAC address, and port mappings to validate DHCP messages and detect illegitimate requests.
Dynamic ARP Inspection
DAI
A security feature on managed switches that validates ARP messages against the DHCP snooping binding database, dropping packets with invalid IP-to-MAC address mappings.
Media Access Control
MAC
A sublayer of the Data Link layer that controls how devices on a network gain access to a medium and transmit data.
Man-in-the-Middle Attack
MitM
An attack where an adversary secretly intercepts and potentially alters communications between two parties.
Port Security
A Cisco switch feature that restricts which devices can connect to a port by limiting the number of allowed MAC addresses or requiring specific MAC addresses to be present. When a violation occurs, the port can be configured to shut down, restrict traffic, or send an alert.

Topics

Ip Source Guard Dhcp Snooping Dynamic Arp Inspection Layer 2 Security Mac Spoofing Switched Networks Networking

Transcript

Spoofing and Why We Need a Guard

We've talked about how easy it is to spoof other devices on the network. All I need to do is go to my computer and set up a new MAC address or an IP address. I've shown you how to set up an IP address on your machine, and suddenly you can assume the identity of something else. If you know the default gateway, you can assume the identity of the default gateway, and then traffic is going to start to direct towards you, causing a denial of service attack, because there are going to be devices that can't get out to the internet since all the traffic is being directed your way. Or it could allow me to leverage that for a man in the middle attack and be able to see the traffic that's coming across the network. So there have got to be protections and guards up to protect my network against that.

It's the same case with IP addresses. IP addresses are easy to spoof, and so we need something. I'm not going to re-cover MAC address spoofing, but I am going to point out that IP Source Guard is one of the things that we can do for protecting ourselves against MAC address spoofing.

IP address spoofing is also pretty straightforward. I don't need any technical skills, I can just go in and statically assign an IP address, causing a denial of service attack, or allowing me to take on the identity of something else on my network, to include something like the default gateway. So it's pretty straightforward, and one of the ways to combat against this is IP Source Guard.

The Layer 2 Filtering We've Covered

We've talked about several layer 2 filtering techniques. We talked about port security, which filters based off of the number of MAC addresses, or a few other things that we can specify in there, or maybe it's a statically assigned MAC address.

We also talked about DHCP snooping, which looks into DHCP messages and filters out the bad messages, or the messages that are suspected to be bad.

We also took a look at dynamic ARP inspection. What dynamic ARP inspection does is take a look at the ARP messages and see if those need to be filtered out or if they can be forwarded on.

And then we also have IP Source Guard. IP Source Guard is just yet the next level of inspection on these frames that are going across these switches. What it's doing is taking a look at the IP address and seeing if it's legitimate, or it can actually look at the MAC address as well.

How IP Source Guard Works

So it is just the next step, and it uses the same process that both DHCP snooping and ARP inspection use. When we set up DHCP snooping on our network, it creates the DHCP snooping binding database. It's a database of MAC addresses and IP addresses and the ports that are associated with those. When we take a look at dynamic ARP inspection, it's looking at the ARP frames that are going across there — the ARP messages that are going across those switches — and taking a look at those and comparing them to that DHCP snooping binding database.

The same thing happens with this IP Source Guard. It's taking a look at that binding database and seeing as traffic comes in from that port whether it has an IP address and a MAC address that makes sense to it, and it can look at all of the traffic with that.

So all the frames that are coming from this demo laptop out to the network, maybe out to the outside world, this switch is going to be analyzing those frames and taking a look at the IP address and matching it up against the binding database to see if it should be coming from that port or not. Obviously it's looking at the source IP address, and we can also look at the MAC address too with that. So that is IP Source Guard.

This is using the same concepts that we've already been talking about. We know what spoofing is, so it makes sense about MAC address spoofing or IP address spoofing and what those are, and IP Source Guard functions very similar to how our other filtering techniques work.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →