DHCP and DHCP Relay explained: DORA, Option 82, snooping

DHCP runs over UDP on ports 67 and 68. The client begins with Discover, a broadcast looking for any available DHCP server. Servers respond with Offer: a proposed IP address, a subnet mask and a lease duration.

The client selects an offer and broadcasts Request, announcing its choice so the other servers release their reservations. Finally the chosen server returns Acknowledge, committing the binding to its database. Until the ACK arrives, the client cannot use the address.

Inside the DHCP payload, the client identifies itself with its hardware MAC address in chaddr. The exchange is tracked by an xid number, so replies match the right request. When the server replies, the assigned address is placed in yiaddr, meaning your IP address.

The rest of the parameters ride inside the Options field: Option 53 for the message type, Option 1 for the subnet mask, Option 3 for the default router, Option 6 for DNS, and Option 51 for the lease time in seconds.

A DHCP address is leased, never owned. Two timers govern the lease. At timer T1, by default 50 percent of the lease time, the client sends a unicast DHCPREQUEST straight to the server that granted the address. If that server answers with an ACK, the timer resets.

If no answer arrives by timer T2, set to 87.5 percent of the lease, the client stops unicasting and broadcasts a DHCPREQUEST to any reachable DHCP server. If the lease expires without an ACK, the host must stop using the address at once and restart DORA from scratch.

The first Discover and Request packets are Layer 2 broadcasts, sent to 255.255.255.255, and routers do not forward Layer 2 broadcasts. If a company has fifty VLANs, placing a dedicated DHCP server inside every subnet is costly and unmanageable.

To keep the DHCP servers centralized in a shared management VLAN or a data centre, the router at the edge of each subnet has to bridge the gap.

This is the role of the DHCP relay agent, often called IP helper. The router listens for DHCP broadcast frames on its client-facing interfaces. When it receives a Discover or a Request, it rewrites the packet as a unicast UDP packet addressed to the central DHCP server.

Crucially, the relay agent stamps its own interface address into the giaddr field, the gateway IP address. When the server receives the packet, it reads giaddr to tell which subnet the client belongs to, and picks the right address pool.

In large networks, knowing the subnet is not enough. The relay agent can append DHCP Option 82 before forwarding the packet. Option 82 carries two key sub-options: the Circuit ID, which identifies the exact switch port and VLAN where the user connected, and the Remote ID, which identifies the switch itself.

This lets administrators assign specific policies or fixed address pools based on the exact physical wall jack, even in a dynamic environment.

Because DHCP Discover is an open broadcast, any machine on the VLAN can answer. If an attacker connects a rogue DHCP server, or a user plugs in a home router, that device races the legitimate server.

If the rogue Offer wins, the host receives an attacker-controlled default gateway and DNS server. The client then routes all of its traffic through the attacker, without raising a single alert.

The defence against rogue servers is DHCP snooping on the access switch. DHCP snooping sorts every switch port into one of two states, trusted or untrusted. Uplink ports facing legitimate infrastructure and DHCP servers are set as trusted; user-facing access ports are untrusted.

If a server message such as a DHCP Offer or a DHCP ACK arrives on an untrusted access port, the switch drops the packet at once, and can disable the port.

As legitimate DHCP traffic passes through the switch, DHCP snooping watches the exchange and builds a dynamic binding table. Each entry records the client MAC address, the leased IP, the lease time, the VLAN and the exact physical port.

This binding table is the foundation of Layer 2 security: Dynamic ARP Inspection and IP Source Guard rely entirely on it to stop ARP poisoning and IP spoofing.

When access switches insert Option 82 and forward the traffic to an upstream distribution switch that has DHCP snooping enabled, a classic trap appears. By default, many switches drop any DHCP packet that already contains Option 82 with a giaddr of zero when it arrives on an untrusted port.

Unless you explicitly allow untrusted Option 82 packets, or disable insertion on the access switches, every downstream client fails to receive an address.

On Cisco, enable the relay with ip helper-address on the SVI, and snooping with ip dhcp snooping and ip dhcp snooping vlan. On Huawei, configure dhcp select relay and dhcp relay server-ip, with dhcp snooping enable globally.

On Aruba AOS-CX, apply ip helper-address under the VLAN interface and enable dhcp-snooping. On Juniper Junos, define the relay under forwarding-options dhcp-relay and enable dhcp-security with trusted interfaces.

Finding a misconfigured helper address, or a forgotten DHCP snooping port, across hundreds of switches takes hours by hand. NacTrack connects over read-only SSH, reads the helper addresses, the DHCP pools and the snooping states on Cisco, Huawei, Aruba and Juniper, and flags the subnets missing relay redundancy and the access ports without snooping protection.