I recently troubleshooted a network where the switch had DHCP snooping turned on and even though the router which was acting as a DHCP server was connected to a trusted port, the client wasn't able to get an IP address.

Upon further packet analysis and debugging both the switch and the router, I found something peculiar:

On the switch:

sw1#debug ip dhcp snooping packet
DHCP Snooping Packet debugging is on
*Jan  9 10:17:29.337: DHCP_SNOOPING: received new DHCP packet from input interface (GigabitEthernet0/0)
*Jan  9 10:17:29.340: DHCP_SNOOPING: process new DHCP packet, message type: DHCPDISCOVER, input interface: Gi0/0, MAC da: ffff.ffff.ffff, MAC sa: 0050.7966.6800, IP da:, IP sa:, DHCP ciaddr:, DHCP yiaddr:, DHCP siaddr:, DHCP giaddr:, DHCP chaddr: 0050.7966.6800
*Jan  9 10:17:29.340: DHCP_SNOOPING: message type : DHCPDISCOVER DHCP ciaddr:, DHCP yiaddr:, DHCP siaddr:, DHCP giaddr:, DHCP chaddr: 0050.7966.6800
*Jan  9 10:17:29.341: DHCP_SNOOPING: add relay information option.
*Jan  9 10:17:29.341: DHCP_SNOOPING_SW: encoding opt82 cid in vlan-mod-port format
*Jan  9 10:17:29.342: DHCP_SNOOPING_SW: Encoding opt82 RID in MAC address format
*Jan  9 10:17:29.342: DHCP_SNOOPING: binary dump of relay info option, length: 20 data:
*Jan  9 10:17:29.343: 0x52 
*Jan  9 10:17:29.343: 0x12 
*Jan  9 10:17:29.344: 0x1 
*Jan  9 10:17:29.344: 0x6 
*Jan  9 10:17:29.345: 0x0 
*Jan  9 10:17:29.345: 0x4 
*Jan  9 10:17:29.346: 0x0 
*Jan  9 10:17:29.346: 0x1 
*Jan  9 10:17:29.347: 0x0 
*Jan  9 10:17:29.347: 0x0 
*Jan  9 10:17:29.347: 0x2 
*Jan  9 10:17:29.348: 0x8 
*Jan  9 10:17:29.348: 0x0 
*Jan  9 10:17:29.349: 0x6 
*Jan  9 10:17:29.349: 0xC 
*Jan  9 10:17:29.350: 0x27 
*Jan  9 10:17:29.350: 0xBB 
*Jan  9 10:17:29.351: 0x0 
*Jan  9 10:17:29.351: 0x9F 
*Jan  9 10:17:29.352: 0x0 
*Jan  9 10:17:29.353: DHCP_SNOOPING_SW: bridge packet get invalid mat entry: FFFF.FFFF.FFFF, packet is flooded to ingress VLAN: (1)
*Jan  9 10:17:29.353: DHCP_SNOOPING_SW: bridge packet send packet to port: GigabitEthernet0/1, vlan 1.

On the Router/DHCP Server:

DHCP#debug ip dhcp server packet
DHCP server packet debugging is on.
*Jan  9 10:17:50.919: DHCPD: inconsistent relay information.
*Jan  9 10:17:50.921: DHCPD: relay information option exists, but giaddr is zero.

After even more digging, I find out that:

Notice that by default Cisco IOS devices reject packets with zero “giaddr” and by default Cisco Catalyst switches use “giaddr” of zero when configured for DHCP snooping! (Source)

Now I don't know much about the giaddr field and understand that the DHCP server is supposed to send the offer to the giaddr address and not the address from which it receives the request.

So, my question is, why does Cisco's switches turn giaddr to all-zeroes when sending the packet to the DHCP server when DHCP snooping is enabled?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.