Which feature can validate address requests and filter out invalid messages?

IP Source Guard uses information from DHCP snooping or static bindings to prevent IP address spoofing by filtering non-matching source IP and MAC addresses, but its primary function is not to validate address requests themselves.

Port security limits and controls which MAC addresses can be learned on a switch port and is primarily concerned with MAC address security, not the validation of IP address requests via DHCP.

DHCP snooping intercepts and analyzes DHCP messages on a switch, building a binding database of legitimate IP-to-MAC address mappings. It can then filter out invalid DHCP messages, such as those from unauthorized DHCP servers or clients attempting to use unassigned IP addresses, thereby validating address requests and enhancing network security.

Dynamic ARP Inspection (DAI) prevents ARP spoofing attacks by validating ARP packets against the DHCP snooping binding table, but it focuses on ARP messages, not the initial DHCP address requests.