What is DHCP Relay?

Understanding DHCP Relay

A DHCP relay is a networking function — a relay agent running on a router or Layer 3 switch — that forwards DHCP messages between clients on one subnet and a DHCP server on another. Because DHCP discovery uses broadcasts that routers do not pass between subnets, the relay agent intercepts those broadcasts and unicasts them to a configured server, letting clients obtain IP addresses from a centralized server they cannot reach directly.

When a client broadcasts a DHCPDISCOVER, the relay agent on its local gateway receives it, fills in the gateway IP address (giaddr) field so the server knows which subnet the request came from, and forwards the packet as unicast to the DHCP server's address. The server uses giaddr to select the correct address pool, then sends its reply back to the relay, which delivers it to the client. This behavior is defined in RFC 1542 (and the relay-agent information option in RFC 3046).

DHCP relay matters because it enables a centralized, manageable DHCP architecture — a few servers serving many subnets — instead of a server on every segment. From a security standpoint, the relay is also a control point: Option 82 (relay agent information) lets the infrastructure record the originating switch port and circuit, supporting accountability and IP-to-location tracking. Relay configuration is tied to DHCP snooping, which validates DHCP traffic to defend against rogue DHCP servers and starvation attacks; a misconfigured or untrusted relay path can undermine those protections.

For example, in an enterprise where users in VLAN 20 need addresses from a DHCP server in the data center, the VLAN 20 gateway is configured with `ip helper-address 10.10.10.5`. When a workstation boots and broadcasts a request, the gateway relays it to 10.10.10.5, stamps the giaddr so the server picks the VLAN 20 pool, and returns the offered address — all without any DHCP server living on the user subnet.