The Dynamic Host Configuration Protocol Version 4 (DHCPv4) Relay Agent Flags Suboption
Extracted elements (12)
Future flag bits must be defined carefully: it will not be possible to distinguish relay agents that understand a new flag and set it to zero from those that simply leave unassigned bits as zero. Therefore, significant behavior changes MUST NOT be based on zero values of future flags.
The motivation for this suboption is that when DHCP clients unicast DHCPREQUEST/RENEW packets to the relay, the server cannot independently determine whether the original packet was broadcast or unicast — information that may affect decisions such as whether to NAK a REBINDING client versus a RENEWING client.
The relay agent MUST always include the Flags Suboption in every relay-agent-information-option so the DHCP server can distinguish a relay agent that supports this suboption (and received a unicast packet) from one that does not support the suboption at all. Without this, absence of the suboption would be ambiguous.
Knowledge of broadcast vs. unicast reception conveyed by this suboption can be used when implementing DHCP load balancing (RFC 3074): a load-balancing server may be willing to respond to a REBINDING client but needs this flag to determine the client's state.
The DHCP server will interact with both relay agents that support and those that do not support the relay-agent-flags suboption. Absence of the suboption indicates either a non-conforming relay or that the relay received a broadcast packet; presence with U=1 unambiguously signals a unicast relay.
A DHCP relay agent that conforms to this specification MUST include the Flags Suboption in every Relay Agent Information Option it adds to a forwarded DHCP request, regardless of whether the packet was received as broadcast or unicast.
Authentication for relay agent options per RFC 4030 SHOULD be deployed as a deeper defense against introduction of fraudulent relay-agent options.
If the DHCP server receives a relay-agent-flags suboption that is longer than one octet, it MUST evaluate only the first octet.
The Flags Suboption (suboption code 10) is a 3-octet structure with a Code field, a Length field (1 octet, value 1), and a Flags octet. The Flags octet contains the UNICAST flag (bit U, value 1 for unicast, 0 for broadcast) and reserved MBZ bits.
IANA assigned suboption number 10 to the Flags Suboption in the DHCP Relay Agent Information Option suboption number space (RFC 3046).
The Flags Suboption depends on a trusted relationship between the DHCP relay agent and the server (per RFC 3046 Section 5). A perimeter defense blocking relay-agent options from untrusted sources can prevent fraudulent options, but the RFC 4030 authentication suboption SHOULD also be deployed for deeper defense.
The Flags Suboption encodes as: Code (1 octet, value 10), Length (1 octet, value 1), Flags (1 octet). Within the Flags octet, bit 0 (U) is the UNICAST flag; bits 1-7 are MUST BE ZERO (MBZ) reserved for future use.