DHCP glossary

What is DHCP Relay Agent?

A DHCP relay agent is a network function that forwards DHCP messages between clients and servers located on different IP subnets. It converts client broadcasts into unicast packets addressed to a DHCP server and records the originating subnet in the giaddr field, so the server can choose the correct address scope.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

A DHCP relay agent is a network function that forwards DHCP discovery messages from clients on one IP subnet to DHCP servers located on different subnets, converting client broadcasts into unicast packets and recording the originating subnet in the giaddr field so the server can assign the correct address scope. Without relay agents, each subnet would require its own DHCP server, multiplying hardware and maintenance overhead; with relays, centralized servers can efficiently serve hundreds of VLANs with scopes managed in one location. Operational challenges include misconfigurations such as missing helper addresses on new VLANs, firewall blocks on UDP port 67, giaddr mismatches with defined scopes, and stale server address lists that can leave clients without addresses despite server health appearing normal.

  • DHCP relay agents typically run on routers or Layer 3 switches and use UDP port 67 to forward client requests as unicast messages while setting the giaddr field to enable server scope selection across multiple subnets.
  • Relay agent information (option 82) defined in RFC 3046 allows servers to identify which switch port or circuit a request originated from, supporting security policies and tracing while complementing switch features like DHCP snooping that filter rogue server replies.
  • Common operational failures include missing relay configuration on new VLANs, scope mismatches when relay interface addresses do not correspond to server-defined subnets, firewall rules blocking DHCP traffic, and stale server address lists after server replacements or readdressing events.

DHCP relay agent at a glance

AttributeValue
CategoryNetwork protocol function
Defined inRFC 951 (BOOTP relay behavior), RFC 1542, and RFC 2131 for DHCP
Protocol and portUDP; clients use port 68 and servers and relay agents use port 67
OSI layerLayer 7 (application), running on a router or Layer 3 switch
Primary useLetting a central DHCP server assign addresses to clients on remote subnets
Related termsDHCP, DHCP server, DHCP scope, DHCP option 82, IP helper address, IPAM

How DHCP relay agent works

DHCP clients find servers with broadcasts, and routers do not forward broadcasts between subnets. A relay agent, usually configured on the router or Layer 3 interface facing the clients, bridges that gap.

  1. Client broadcast: A client without an address broadcasts a DHCP Discover message on its local subnet.
  2. Relay receives the message: The relay agent listening on that interface receives the broadcast and sets the giaddr field to the IP address of the interface that received it.
  3. Unicast to the server: The relay forwards the message as unicast to one or more configured DHCP server addresses. It may also add relay agent information, known as option 82.
  4. Server selects a scope: The DHCP server uses the giaddr value to match the request to a scope for that subnet and builds an Offer from it.
  5. Reply returned to the client: The server sends the reply to the giaddr address. The relay then delivers it to the client, by broadcast or unicast, on the client subnet.

The same relay path carries the Request and Acknowledgment messages that complete the exchange. Later renewals are usually unicast directly between client and server and do not need the relay. Relay agent information is removed before the reply reaches the client.

Why DHCP relay agent matters in enterprise networks

Relay agents make centralized DHCP practical. Without them, each subnet would need its own DHCP server, which multiplies hardware, configuration and maintenance. With relays, a small number of redundant servers can serve hundreds of VLANs, and scopes can be managed in one place.

Operationally, the relay is a dependency that is easy to overlook. A wrong server address, a missing helper configuration on a new VLAN, or a firewall blocking UDP port 67 leaves clients without addresses while the server appears healthy. Because the giaddr value selects the scope, a mismatch between the relay interface address and the scopes defined on the server causes requests to be ignored or answered from the wrong pool.

For security, relay agent information (option 82, described in RFC 3046) lets a server see which switch port or circuit a request came from, supporting policy and tracing. Relays also extend the reach of rogue DHCP servers if unauthorized servers are listed as targets, so relay configuration should be controlled and audited. Switch features such as DHCP snooping complement relays by limiting which ports may send server replies.

DHCP relay agent vs DHCP snooping

A relay agent forwards DHCP messages across subnets, while DHCP snooping is a switch security feature that filters DHCP messages to block untrusted servers. What is DHCP Snooping?

AttributeDHCP relay agentDHCP snooping
Primary purposeCarry client requests to a server on another subnetBlock rogue DHCP servers and validate DHCP traffic
Typical locationRouter or Layer 3 interface facing clientsAccess or Layer 2 switch ports
Effect on messagesConverts broadcasts to unicast and sets giaddrPermits or drops messages based on port trust
Required for multi-subnet DHCPYes, unless a server sits on each subnetNo

DHCP relay agent vs Default gateway

A default gateway is the router address clients use to reach other networks, while a relay agent is a function that forwards DHCP messages and is often run on that same router. What is Default Gateway?

Common DHCP relay agent issues

A new VLAN is created and its interface is given an address, but no relay target is configured. Clients on it fail to get leases and fall back to link-local addresses, while other VLANs work normally.

The server has no scope whose subnet contains the relay interface address, so it ignores or rejects requests. This often happens after renumbering a subnet or when a secondary address on the interface is used as giaddr.

A firewall between relay and server drops UDP ports 67 or 68, or the return path for server replies. Server logs show no requests, or offers are sent but never reach clients.

After a server is replaced or readdressed, relays still point to the old address. Failover pairs then appear healthy, yet some relays only reach one peer or none.

A relay inserts option 82 data the server does not expect, or a downstream device adds it a second time. The server may reject the packet or match the wrong policy, so clients on certain ports are denied or misassigned.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

DHCP relay agent FAQ

Related terms

Article

DHCP (Dynamic Host Configuration Protocol)

DHCP (Dynamic Host Configuration Protocol) is the standard mechanism to dynamically assign IP addresses within a network.

Learn more
Article

DHCP Scope

A DHCP scope defines the range of IP addresses and related configuration settings that a DHCP server can assign to devices on a network segment.

Learn more
Article

DHCP Snooping

DHCP snooping is a network security feature that monitors DHCP traffic and prevents unauthorized DHCP servers from assigning IP addresses to network devices.

Learn more
Article

DORA process

The DORA process is the four-step sequence of Discover, Offer, Request, and Acknowledge messages exchanged between DHCP client and server to assign an IP address.

Learn more
Article

DHCPDISCOVER

DHCPDISCOVER is the initial message sent by a DHCP client to discover available DHCP servers on the network.

Learn more
Article

Default Gateway

A default gateway is the network device, typically a router, that forwards traffic from a local network to destinations outside its subnet.

Learn more
Article

IPAM (IP address management)

IP address management (IPAM) is a method for planning, tracking, and managing IP address space on a network.

Learn more
Article

DDI (DNS, DHCP, and IPAM)

DDI (DNS, DHCP, and IPAM) integrates DNS, DHCP, and IPAM into one management solution.

Learn more
Browse the full glossary