DHCP Server Identifier Override Suboption
Extracted elements (15)
In RENEWING state, DHCP clients send DHCPREQUESTs directly to the server specified in the Server Identifier option, bypassing the relay. This suboption lets the relay inject its own address into the Server Identifier so it intercepts renewals and can include Relay Agent Information suboptions (Circuit-ID, Remote-ID, etc.) that are required by the server but absent from direct renewals.
This suboption brings DHCPv4 relay behavior into parity with DHCPv6 relay operation (RFC 3315), where the relay already functions as the apparent server address for the client.
If a DHCP server does not understand this suboption, it will ignore it and insert its own interface address in the Server Identifier option, causing RENEW DHCPREQUESTs to bypass the relay. Administrators should confirm that the target server supports the suboption before deploying it.
DHCP relay agents implementing this suboption SHOULD also implement and use the DHCPv4 Relay Agent Flags Suboption (RFC 5010) to indicate whether the original message was received as broadcast or unicast.
DHCP servers that implement this suboption MUST use the address specified in the Server Identifier Override Suboption, if present in a message received from a client, as the value to insert into the Server Identifier option in the corresponding response.
In a situation where the DHCP relay agent is configured to forward messages to more than one server, the relay agent SHOULD forward all DHCP messages (including RENEW DHCPREQUESTs) to all servers, so the relay does not need to maintain lease state.
The DHCP relay agent should fill in the giaddr field when relaying the message, just as it normally would.
The DHCP server must also record the address from the suboption for use in subsequent messages to the DHCP client until the next DHCP message is received from the DHCP relay agent.
When a DHCPREQUEST contains a Server Identifier Override suboption, the server should compare the address in the suboption against the Server Identifier option; if they match, the server should accept the DHCPREQUEST regardless of whether the Server Identifier matches a DHCP server interface address.
The Server Identifier Override Suboption (suboption 11) is a new suboption of the DHCP Relay Agent Information option that allows a relay agent to specify the value the DHCP server should place into the Server Identifier option in its reply, causing RENEW DHCPREQUESTs to be directed to the relay rather than the server.
IANA assigned suboption number 11 to the Server Identifier Override Suboption within the DHCP Relay Agent Information Option suboption number space (RFC 3046).
A rogue DHCP relay agent using this suboption could redirect clients to itself, then deny RENEW DHCPREQUESTs to force lease expiration, or manipulate DHCP options in DHCPACK messages and extend leases beyond server policy. DHCP authentication (RFC 3118) and/or Relay Agent Information option authentication (RFC 4030) SHOULD be deployed to mitigate this.
The Relay Agent Information option depends on a trusted relationship between relay and server (RFC 3046 Section 5). A perimeter defense blocking untrusted relay agent information options is recommended, with deeper defense via the authentication suboption (RFC 4030) as well.
Without DHCP authentication, a rogue relay can modify the Server Identifier Override option in DHCPOFFER and DHCPACK messages undetected; this threat pre-exists this suboption. This document does not introduce new vulnerabilities except when DHCP authentication is already required by clients.
The suboption encoding is: Code=11 (1 octet), Len=4 (1 octet), followed by four octets (a1–a4) carrying the overriding IPv4 Server Identifier address. The option length n is always 4.