DHCP snooping
Switch feature that filters DHCP responses from non-trusted ports. Protection against a rogue DHCP server that hands out malicious gateways/DNS to MITM clients. Standard on enterprise switches.
Configuration: declare some ports as "trusted" (where legitimate DHCP servers live), the rest "untrusted" (client ports). DHCP responses from untrusted are dropped. Simultaneously builds a DHCP snooping binding table: IP↔MAC↔port mapping to accept legitimate leases. Drives Dynamic ARP Inspection (DAI) — switch validates ARP against the snooping table → ARP spoofing blocked. IP Source Guard takes it further to IP/MAC enforcement per port. Classic Cisco CCNP curriculum. Must be configured per VLAN.