for preventing rouge DHCP server
there is feature in cisco switches called dhcp snooping
this feature prevent any port to send dhcp offers unless it consdered trused based on the configuration
so all port will be untrusted except ports that connected to a dhcp server and links between switches
this is in brief
and this feature also build a data base on the swtich that contain the client ip from the dhcp and the mak address in that port
this data base of dhcp snooping can be used with another feature called ip source gurd
which prevent any ip address that not in that data base in other words the ip must be in the data bse maped to mac address
so if some one try to pretend him self as another on by useing spoofed ip will not be able to do that
good luck
please, if helpful rate
