6 Replies Latest reply: Feb 16, 2015 9:44 AM by sarah RSS

    DHCP Relay (IP Helper-Address)

    Brett

      Does issuing the IP Helper-Address on an interface instruct the interface to de-encapsulate all Broadcast packets?

      It seems like it would be overkill to de-encapsulate all broadcast packets just to look for a DHCP Discover Message.

      I understand the need, but wonder why there is no specific MAC address for these types of messages. Not trying to re-invent the wheel, just trying to understand the thought process.

       

      Thanks, Brett

        • 1. Re: DHCP Relay (IP Helper-Address)
          raymond

          thats a good question, I would think so concidering its a broadcast ethernet frame. all devices who receive that frame would de-encapsulate the frame to check the IP headers to see if its destined for them/DHCP server

           

          Hence the reason with IPv6 there is no broadcast anymore.

          • 2. Re: DHCP Relay (IP Helper-Address)
            sarah

            If you are asking about just the relay agent, the DHCP discover is sent with a destination of 255.255.255.255 with all F's for layer 2. This is limited broadcast."Reserved for the "limited broadcast" destination address, as specified by RFC 6890, used during host configuration.

             

            The address 255.255.255.255 denotes a broadcast on a local hardware  network, which must not be forwarded.  This address may be used, for    example, by hosts that do not know their network number and are asking some server for it.

            https://tools.ietf.org/html/rfc919#section-7

             

             

            To analyze DHCP Discover (lease request) traffic:

            1. In the top Wireshark packet list pane, select the fourth DHCP packet, labeled DHCP Discover.
            2. Observe the packet details in the middle Wireshark packet details pane. Notice that it is an Ethernet II / Internet Protocol Version 4 / User Datagram Protocol / Bootstrap Protocol frame.
            3. Expand Ethernet II to view Ethernet details.
            4. Observe the Destination and Source fields. The destination should be the broadcast address ff:ff:ff:ff:ff:ff and the source should be your MAC address. When the client doesn't have an IP address or server information, it has to broadcast to discover a DHCP server.
            5. Expand Internet Protocol Version 4 to view IP details.
            6. Observe the Source address. Notice that the source address is 0.0.0.0, indicating no current IP address.
            7. Observe the Destination address. Notice that the destination address 255.255.255.255, the broadcast IP address.
            8. Expand User Datagram Protocol to view UDP details.
              1. Observe the Source port. Notice that it is bootpc (68), the BOOTP client port.
            9. Observe the Destination port. Notice that it is bootps (67), the BOOTP server port.
            10. Expand Bootstrap Protocol to view BOOTP details.
            11. Observe the DHCP Message Type. Notice that it is a Discover (3).
            12. Observe the Client IP address, Client MAC address, and DHCP option fields. This is the request to the DHCP server.

            Don't take my word for it, not sure what else 255.255.255.255 as destination is used for,

            • 3. Re: DHCP Relay (IP Helper-Address)
              Aref - CCIE #62163 (Security) / CCNPx2 (R&S - Security) / Network+ / Security+

              Hi Brett,

               

              The "ip helper-address" command is not used only to rely the DHCP broadcast messages, instead it can be used to forward other kind of udp traffic. By enabling "ip helper-address" all udp traffic defined with the command "ip forward-protocol udp" manually or by default (BOOTP client and server are defined by default) will be forwarded by the router as a unicast traffic. In other words the "ip helper-address" command is not used only to rely the DHCP messages. If you want to allow the router to forward only the DHCP messages then you should remove all the other protocols with the command "no ip forward-protocol udp".

               

               

              Regards,

              Aref

              • 4. Re: DHCP Relay (IP Helper-Address)
                Mike Gannon

                Yes, Layer 1,2, & 3 are decasulated to forward the PDU.

                The IP source address (host) is replaced with the router interface or SVI IP address that the broadcast was recieved from, and the destination (broadcast) address gets replaced with the remote server address. So yes

                You can think of the router interface as a proxy gateway for DHCP 

                 

                The router keeps track of the MAC address of the requesting host and knows to apply the DHCP reply message to that MAC.

                • 5. Re: DHCP Relay (IP Helper-Address)
                  Brett

                  Wow, amazing stuff coming out of these responses. Aref I went hunting for other kinds of UTP traffic the command IP-Helper Address enables the router to de-encapsulate (thanks Mike Gannon). http://www.cisco-faq.com/163/forward_udp_broadcas.html

                  Then I found some great stuff circa 2003 on a Dell site which made me feel further validated about my question.  I know the Broadcast storms are the worst offenders as far as CPU and Bandwidth eating. And of course STP takes care of that.  And I re-learned that IGMP snooping with help to limit Multicast traffic.

                   

                   

                  I also learned from one of my CCIE friends, that the amount of broadcast traffic on a properly built network (VLAN's, STP, SVI's) would not usually eat enough CPU resources or bandwidth to be concerned with. I don't know much about SVI (apparently used on L3 Switches), but I believe him.

                  Here's the intro quote from Dell and the link: http://www.dell.com/downloads/global/products/pwcnt/en/app_note_5.pdf
                  Broadcast and multicast traffic perform valuable roles in
                  terms of network discovery and content delivery,
                  but too much of either can have an adverse effect
                  on performance. Excessive amounts of broadcast or
                  multicast traffic not only waste bandwidth, but also
                  degrade the performance of every device attached to
                  the network. This application note discusses the steps
                  network managers can take to minimize the effects
                  of broadcast and multicast traffic without compromi
                  sing application functionality or performance.
                  • 6. Re: DHCP Relay (IP Helper-Address)
                    sarah

                    A lab output on the same


                    2-16-2015 9-37-43 PM.jpg


                    R3(config)#int f1/0
                    R3(config-if)#ip address 172.16.128.1 255.255.255.0
                    R3(config-if)#no shutdown
                    R3(config-if)#ip helper-address 172.16.32.32
                    R3(config-if)#int f0/0
                    R3(config-if)#ip address 172.16.32.31 255.255.255.0
                    R3(config-if)#no shutdown
                    R3(config-if)#exit
                    R3#debug ip dhcp server packet
                    R3#debug ip dhcp server events


                    R3(config)#int f1/0

                    R3(config-if)#ip address 172.16.128.1 255.255.255.0

                    R3(config-if)#no shutdown

                    R3(config-if)#ip helper-address 172.16.32.32

                    R3(config-if)#int f0/0

                    R3(config-if)#ip address 172.16.32.31 255.255.255.0


                    Debug Output on R1


                    ---omitted-----

                    R1#

                    *Mar  1 00:06:25.375: DHCPD: DHCPDISCOVER received from client 0100.5079.6668.00 through relay 172.16.128.1.


                    DHCP Discover to 172.16.32.32 from 172.16.128.1

                    Ethernet II, Src: cc:07:23:70:00:00 (cc:07:23:70:00:00), Dst: cc:05:23:70:00:00 (cc:05:23:70:00:00)
                    Internet Protocol Version 4, Src: 172.16.128.1 (172.16.128.1), Dst: 172.16.32.32 (172.16.32.32)Unicast from relay to server
                    User Datagram Protocol, Src Port: bootps (67), Dst Port: bootps (67)
                    Bootstrap Protocol
                       ------omitted----
                        Bootp flags: 0x0000 (Unicast)
                        Client IP address: 0.0.0.0 (0.0.0.0)
                        Your (client) IP address: 0.0.0.0 (0.0.0.0)
                        Next server IP address: 0.0.0.0 (0.0.0.0)
                       Relay agent IP address: 172.16.128.1 (172.16.128.1) --> Relay agent IP address embedded in the packet, is how the DHCP server determines the pool to assign the IP address from.