This per-port setting turns on IP Source Guard, a feature that uses the DHCP snooping binding table to verify that traffic entering a port actually comes from the IP address that port was legitimately assigned via DHCP, blocking spoofed-source traffic; it defaults to off. Administrators enable this on access ports as an added layer of protection against IP spoofing attacks once DHCP snooping bindings are being properly tracked. For example, turning this on(1) for a user access port would cause the switch to drop any traffic from that port claiming a source IP address that doesn't match what DHCP snooping recorded for that client.