DHCP Relay Agents

The Broadcast Dilemma

DHCP's four-way handshake (DISCOVER, OFFER, REQUEST, ACK) begins with a broadcast. A client with no IP address sends a DHCPDISCOVER to $255.255.255.255$ — the limited broadcast address, which routers do not forward by design. In a flat network with one VLAN and one subnet, this works fine: the DHCP server sits in the same broadcast domain.

Scale this to a university campus with 500 VLANs, or a hospital with 200 isolated clinical segments, or an ISP with thousands of subscriber VLANs. Deploying individual DHCP servers in each segment is operationally impossible and creates an enormous management surface for IP address conflicts, scope mismanagement, and security gaps. The solution is centralized DHCP services — accessed across Layer 3 boundaries via DHCP Relay.

Internal Header Modification: GIADDR in Depth

The key to the relay mechanism is the GIADDR (Gateway IP Address) field in the BOOTP/DHCP packet header. When a relay agent intercepts a DHCPDISCOVER, it:

• Sets the GIADDR field to the IP address of its interface on the client's subnet (not its management interface).
• Increments the "hops" field by 1 (each relay agent increments this; servers reject packets with hops exceeding a threshold, preventing loops).
• Forwards the modified packet to the DHCP server as a unicast.

The DHCP server uses the GIADDR to identify the correct scope (pool). It selects an available IP address from the matching subnet and sends the DHCPOFFER back to the GIADDR address as destination.

DHCP Option 82: Circuit-Level Metadata

In large ISP or campus environments, knowing the source subnet is insufficient. A DHCP server managing cable modem or DSL subscribers needs to know exactly which physical port, which DSLAM, and which subscriber line originated a request to enforce per-subscriber policies. Option 82 (RFC 3046) — the Relay Agent Information Option — addresses this.

Option 82 is a container option with sub-options inserted by the relay agent:

• Sub-option 1 — Agent Circuit ID: Identifies the specific VLAN and physical port on the access switch (e.g., "Gi0/1, VLAN 100"). Format is vendor-specific but commonly encodes switch hostname, slot/port, and VLAN ID.
• Sub-option 2 — Agent Remote ID: Identifies the relay agent itself — typically its MAC address or SNMP system name. Useful when multiple relay agents forward to the same server.
• Sub-option 5 — Link Selection: Allows the relay agent to specify a different subnet for scope matching than implied by GIADDR — useful in VRF-aware or complex multi-tenant deployments.

The DHCP server uses these sub-options to assign addresses from policy-defined pools, enforce MAC-to-port bindings, trigger subscriber activation workflows, or log events for billing and audit systems.

The Return Path and Relay in HA Environments

The DHCP server addresses its DHCPOFFER to the unicast GIADDR. The relay agent receives the offer and must relay it back to the client. For clients that do not yet have an IP (during DISCOVER/OFFER), the relay agent broadcasts the offer onto the local VLAN. For DHCPREQUEST and DHCPACK (where the client knows its tentative IP), many implementations switch to unicast delivery, reducing VLAN noise.

In high-availability gateway designs — HSRP, VRRP, GLBP — relay configuration requires careful attention. The IP Helper-Address (Cisco's relay configuration command) must be identically configured on both active and standby routers. If the standby lacks the helper, clients only obtain addresses when the active peer is forwarding. The GIADDR should be set to the SVI (Switched Virtual Interface) address on the physical device — NOT the virtual gateway IP — so the server can return packets correctly regardless of which router is active.

DHCPv6 and the Relay Equivalent

IPv6 uses DHCPv6 (RFC 3315) with a similar relay architecture. DHCPv6 Relay Agents forward messages encapsulated in Relay-Forward messages using the interface's link-local address as the peer-address. Option 18 (Interface ID) and Option 37 (Remote ID) serve the same roles as Option 82 sub-options 1 and 2. In dual-stack networks, both DHCP and DHCPv6 relay must be configured independently on the gateway interface — they use separate databases, separate scopes, and separate relay processes even when running on the same hardware.