How does a DHCP relay router forward the packet to the server

How Routers Handle Limited and Directed Broadcasts

The first thing to understand to answer your questions is that limited broadcast frames are not routed. By default when a router receives a frame with a destination address that is broadcast at either layer 2 or layer 3, the router simply drops the frame. That's why routers are said to be the boundary of broadcast domains.

Some examples of these would be:

• ff-ff-ff-ff-ff-ff (layer 2 broadcast)
• 255.255.255.255 (layer 3 limited broadcast)

Thinking about it, this makes sense. If routers forwarded broadcasts a single arp request would reach every single reachable host on the internet which would be terribly inefficient and rather silly.

Directed broadcasts on the other hand are sometimes routed. (I.E. 192.168.1.255/24) Normally by default this functionality is disabled but can be enabled by issuing the ip directed-broadcast command on the router. This will allow it to forward directed broadcasts according to its routing table as if they were normal packets. This does not however allow the router to forward limited broadcasts, those are still blocked by default. This is also slightly off topic as to your original question, see this cisco forms page for more on this.

Layer 3 Broadcast But not Layer 2?

To answer your second question, it would make no sense to have a frame with a layer 3 broadcast address without a layer 2 broadcast address. This would defeat the entire purpose of it being a broadcast frame and just not work outright. Having a unicast layer 2 destination address would not change the router's behavior at all since the router makes its decisions at layer 3. All the router cares about is that 255.255.255.255 destination address and drops the packet.

Where this would matter is with switches which don't care about the layer 3 address at all. The switches would only see the unicast layer 2 address. Instead of sending the packet out all interfaces on the same vlan it would use the source address table (SAT) like it would with any other unicast destination address. In effect, by assigning a unicast layer 2 address the frame is no longer a broadcast frame at all even though it has the 255.255.255.255 address at layer 3.

How DHCP Relay Works in Practice

As for your last question, DHCP relay is a router's way of "cheating" around the rule about not forwarding broadcast packets. Let's look at a DHCP Discover packet:

• Source MAC: [unicast mac of the source]
• Dest MAC: ff-ff-ff-ff-ff-ff
• Source IP: 0.0.0.0
• Destination IP: 255.255.255.255
• Source Port: UDP 68
• Destination Port: UDP 67

When the router sees a packet arrive on an interface with the ip helper-address command configured it checks to see is it matches any of the protocols that are "helped" by default or configured with the global ip forward-protocol command. In this case because it's DHCP the router sees that the destination port matches UDP 67 and allows the packet to be "helped". The router then changes the destination IP address from 255.255.255.255 to the IP address configured by the ip helper-address command as well as changing the source address to the address of the router interface on which the packet arrived and passes the packet along to the rest of the routing logic.

Now that the packet has a unicast destination address the router treats it like any other packet. It arps for the destination IP address (which is now that helper address) and then replaces the layer 2 addresses before sending the packet out the appropriate interface.

Getting Back Again

The router uses essentially the same process in reverse for the DHCP offer that is sent back to the client. The DHCP servers sends the offer to the IP address that was specified as the source address on the DHCP Discover packet. So the packet leaving the DHCP server looks like:

• Source MAC: unicast mac of the DHCP server
• Dest MAC: mac address of the router or the DHCP server's default gateway
• Source IP: unicast IP address of the DHCP server
• Destination IP: ip address of the first router interface that the DHCP Discover packet reached
• Source Port: UDP 67
• Destination Port: UDP 68

Since this packet has a unicast layer 3 destination address routers will forward the packet normally until it reaches the router with an interface that has an IP address matching the destination IP of the packet. Remember from earlier that this router has the ip helper-address configuration on that interface still. The router checks if the packet is a DHCP Offer then rewrites the packet to become a broadcast packet and sends it back out that interface knowing that the DHCP client is somewhere on that network segment. The packet leaving the router now looks like this.

• Source MAC: unicast mac of the router interface
• Dest MAC: ff-ff-ff-ff-ff-ff
• Source IP: unicast IP address of the DHCP server
• Destination IP: 255.255.255.255
• Source Port: UDP 67
• Destination Port: UDP 68

TL:DR; DHCP relay using the ip helper-address interface subcommand "cheats" around the rule that routers cannot forward limited broadcasts by changing the packet's destination IP address to the unicast IP address of the DHCP server before routing it. This allows all routers down the line to route the packet appropriately to the DHCP server. When replying the DHCP server sends the packet back to the unicast IP address of the router interface that first received the DHCP Discover packet (the one with the ip helper-interface command). When the router receives the offer back it converts it back to a broadcast packet and sends it out the interface with the client in its broadcast domain.

This is because the DHCP server must reside or have a relay/proxy on the same L2 network as the client.

The DHCP OFFER is sent to the L2 address of the client (i.e. it's MAC address). If the request was relayed/proxied, then the DHCP OFFER goes to the relay/proxy which will then forward it to the correct L2 network.

Broadcast traffic can be problematic for networks, so this reduces the amount of broadcast network that is necessary.