Lesson Contents
This packet capture shows DHCP on the link between a relay agent and the DHCP server. The client (H1) is on another subnet. Its router (192.168.12.2) catches the broadcast and forwards it as unicast to the server (192.168.23.3), adding two things on the way: its own address in the giaddr field, and option 82, the relay agent information option.
Those two fields are what the server uses to pick the right pool and what you’ll look for when relayed DHCP doesn’t work. The Cisco IOS DHCP relay agent lesson covers the configuration. More captures are in the Packet Capture Library.
Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.
Create a free account to download the pcap
Already have an account? Log in and the download button appears here.
Capture overview
| File | dhcp-relay-agent-giaddr-option-82.pcapng |
| Packets | 4 |
| Protocol | DHCP (RFC 2131), relay agent information option 82 (RFC 3046) |
| Transport | UDP 67 → 67, unicast between relay and server |
| Capture point | Between the relay agent (192.168.12.2) and the DHCP server (192.168.23.3) |
| Devices | Cisco IOS routers, client H1 with MAC 52:54:00:d0:ae:e6 |
| Wireshark filter | dhcp.option.type == 82 or dhcp |
Packets in this capture
No. Time Source Destination Protocol Info
1 0.000000 192.168.12.2 192.168.23.3 DHCP DHCP Discover - Transaction ID 0x55d
2 2.229338 192.168.23.3 192.168.12.2 DHCP DHCP Offer - Transaction ID 0x55d
3 2.441673 192.168.12.2 192.168.23.3 DHCP DHCP Request - Transaction ID 0x55d
4 2.580418 192.168.23.3 192.168.12.2 DHCP DHCP ACK - Transaction ID 0x55dPacket walkthrough
Relayed Discover (packet 1)
Internet Protocol Version 4, Src: 192.168.12.2, Dst: 192.168.23.3
User Datagram Protocol, Src Port: 67, Dst Port: 67
Dynamic Host Configuration Protocol (Discover)
Message type: Boot Request (1)
Hardware type: Ethernet (0x01)
Hardware address length: 6
Hops: 1
Transaction ID: 0x0000055d
Seconds elapsed: 3
Bootp flags: 0x8000, Broadcast flag (Broadcast)
1... .... .... .... = Broadcast flag: Broadcast
.000 0000 0000 0000 = Reserved flags: 0x0000
Client IP address: 0.0.0.0
Your (client) IP address: 0.0.0.0
Next server IP address: 0.0.0.0
Relay agent IP address: 192.168.12.2
Client MAC address: 52:54:00:d0:ae:e6 (52:54:00:d0:ae:e6)
Client hardware address padding: 00000000000000000000
Server host name not given
Boot file name not given
Magic cookie: DHCP
Option: (53) DHCP Message Type (Discover)
Length: 1
DHCP: Discover (1)
Option: (57) Maximum DHCP Message Size
Length: 2
Maximum DHCP Message Size: 1200
Option: (61) Client identifier
Length: 27
Type: 0
Client Identifier: cisco-5254.00d0.aee6-Gi0/1
Option: (12) Host Name
Length: 2
Host Name: H1
Option: (55) Parameter Request List
Length: 8
Parameter Request List Item: (1) Subnet Mask
Parameter Request List Item: (6) Domain Name Server
Parameter Request List Item: (15) Domain Name
Parameter Request List Item: (44) NetBIOS over TCP/IP Name Server
Parameter Request List Item: (3) Router
Parameter Request List Item: (33) Static Route
Parameter Request List Item: (150) TFTP Server Address
Parameter Request List Item: (43) Vendor-Specific Information
Option: (60) Vendor class identifier
Length: 8
Vendor class identifier: ciscopnp
Option: (82) Agent Information Option
Length: 14
Option 82 Suboption: (2) Agent Remote ID
Length: 12
Agent Remote ID: 020a0000c0a80c0201000000
Option: (255) End
Option End: 255This is what the fields in red mean:
- Unicast from 192.168.12.2 to 192.168.23.3: the client broadcast its Discover, but the relay forwards it to the server’s address. Routers don’t forward broadcasts, which is why relaying is needed.
- UDP 67 → 67: relayed messages use the server port on both sides. A client’s own Discover goes from port 68 to 67.
- Hops: 1: the relay increments this field. A client always sends 0.
- Relay agent IP address (giaddr) 192.168.12.2: the relay’s interface on the client’s subnet. The server uses it to choose the pool (192.168.12.0/24) and sends its reply back to this address.
- Client MAC address: still the client’s own MAC. The relay doesn’t change the client’s fields.
- Option 82, suboption 2 (Agent Remote ID): added by the relay. This router inserts a remote ID only, no circuit ID suboption. You can read the relay’s own address in the value:
c0a80c02is 192.168.12.2. The relay adds option 82 as the last option, right before End.
Offer from the server (packet 2)
I left out the fixed fields and option details, so only the relay-related fields are shown here.
User Datagram Protocol, Src Port: 67, Dst Port: 67
Dynamic Host Configuration Protocol (Offer)
Hops: 0
Your (client) IP address: 192.168.12.1
Relay agent IP address: 192.168.12.2
Option: (53) DHCP Message Type (Offer)
Option: (54) DHCP Server Identifier (192.168.23.3)
Option: (51) IP Address Lease Time
Option: (58) Renewal Time Value
Option: (59) Rebinding Time Value
Option: (1) Subnet Mask (255.255.255.0)
Option: (82) Agent Information Option
Option 82 Suboption: (2) Agent Remote ID
Agent Remote ID: 020a0000c0a80c0201000000
Option: (255) EndHere’s what stands out:
- Your (client) IP address 192.168.12.1: the server picked an address from the subnet that matches the giaddr.
- Relay agent IP address 192.168.12.2: the server keeps the giaddr and sends the Offer to the relay, not to the client.
- Option 82 echoed back: the server returns the relay agent information unchanged. The relay uses it, then removes it before it forwards the Offer to the client. The client never sees option 82.
Packets 3 and 4 (Request and ACK) look the same: giaddr 192.168.12.2, option 82 in both directions.