Subscriber-ID Suboption for the Dynamic Host Configuration Protocol (DHCP) Relay Agent Option
Extracted elements (12)
Existing relay agent suboptions (Remote-ID, Circuit-ID) are based on physical network resources like IP addresses or ATM virtual circuit identifiers, making them path-dependent. The Subscriber-ID suboption was designed to carry a stable, provider-assigned value independent of the physical connection path, so clients connecting through different paths receive consistent identification.
The Subscriber-ID suboption complements rather than replaces existing network-based relay agent suboptions (Remote-ID, Circuit-ID defined in RFC 3046), and both may be used together in the same relay agent information option.
A deeper defense using authentication for relay agent options via the Authentication Suboption or IPSec SHOULD be deployed in addition to perimeter defenses that block untrusted relay agent options.
DHCP relay agents MAY be configured to include a Subscriber-ID suboption when they include a relay agent information option in relayed DHCP messages.
The Subscriber-ID string MUST NOT be NULL terminated; the length is specified in the Len field.
The Subscriber-ID suboption may convey information that identifies a specific host or user. If DHCP messages travel outside the service provider's network or suboption values become visible to other users, this may raise privacy concerns. Administrators should use identifiers appropriate to the network type.
The semantic contents of the Subscriber-ID string are provider-specific; this specification establishes no semantic requirements on the string data. The assignment and configuration of subscriber-id strings are outside the scope of this memo.
The Subscriber-ID suboption allows a DHCP relay agent to associate a stable, provider-assigned identifier with DHCP client messages, independent of the physical network infrastructure through which the subscriber connects.
IANA assigned suboption code 6 from the DHCP Relay Agent Information Option suboption codes registry for the Subscriber-ID Suboption defined in this document.
The DHCP relay agent option depends on a trusted relationship between the relay agent and server. Fraudulent relay agent option data could lead to theft-of-service, exhaustion of IP addresses, denial of service to legitimate hosts, or assignment of inappropriate configuration parameters.
While perimeter defenses can block fraudulent relay agent options from untrusted agents, authentication via the Authentication Suboption or IPSec should also be deployed as a deeper defense.
The Subscriber-ID suboption has a 1-octet Code field (value 6), a 1-octet Len field indicating the length of the ID string in octets, and a variable-length NVT ASCII Subscriber-ID string with a minimum length of 1 octet.