Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Right now I am trying to troubleshoot an IP helper issue on our network. We have a provisioning system on one vlan (n)/subnet (opsware/HP System Automation), and the server to be provisioned on another separate vlan (30)/subnet. Between them we have two routers using HSRP. The routers have an IP helper configured for vlan 30, forwarding requests to the provisioning system.

We have verified that DHCP requests are being generated by the server. We have verified that the configuration looks correct for the vlan on the routers (in the vlan config, there is an ip-helper configured - there's not a lot complicated about that). We are working to verify that the provisioning system is not getting the dhcp requests, and that's where my question comes up...

When a router uses an ip-helper to redirect a broadcast as a unicast to the helper address, what MAC address is contained in the unicast? Is it the MAC of the router's outbound port, of the original host that generated the broadcast?

Sadly the routers handle a massive amount of traffic, so network engineering is unable to do a debug or packet dump off of the routers, so what's going on in there is currently a black box. At this point I'm working to gather as much evidence as I can to see where the issue lies.

share|improve this question
up vote 1 down vote accepted

The router's DHCP relay agent will receive the broadcast DHCP request from the client, put its own IP address into the GIADDR field of the DHCP packet (identifying itself as the relay agent forwarding the DHCP request) and send a unicast IP packet out whatever interface is "closest" to the destination DHCP server. This unicast IP packet will be encapsulated in an Ethernet frame (if that interface is an Ethernet interface) with a source MAC address of the router (or, in the case of an HSRP pair, the virtual MAC address of the HSRP address). The client MAC address (stored in the CHADDR field of the DHCP request) will be unchanged by the DHCP relay agent on the router. (The DHCP Relaying portion of the Wikipedia article on DHCP might be helpful to you to get a deeper understanding.)

If there are "hops" between the DHCP server and the router relating the DHCP request for the client then the source MAC address on the relayed DHCP request packet will end up being the interface of the last-hop router between the DHCP server and the relaying-router.

I'd start sniffing traffic closest to the provisioning system looking for DHCP packets and whittling things down from there. I'd also make sure that I can get other types of traffic (like, say, PING) from the relaying router to the DHCP server.

share|improve this answer
Awesome, thank you! I have verified that ICMP traffic makes it all the way through, so I'm pretty sure that's not the issue. I just wanted to make sure that somewhere in the packet received by the DHCP server there would be the originating host's MAC address. I wanted to make sure that if I searched through my packet captures it would be in there. With that evidence I can ask the network team to take another look at how things are configured; they're the ones who will have to sniff the traffic (access reasons). Appreciate it!! – Matthew Aug 10 '11 at 20:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.