The first one reaches the NICs in the network segment, routers don't forward it, so it's limited. The second will reach all the hosts in the network if it's allowed by a router, so it's directed.
If you're talking about pinging 10.255.255.255, it's directed.
How Routers Handle Limited and Directed Broadcasts
The first thing to understand to answer your questions is that limited broadcast frames are not routed. By default when a router receives a frame with a destination address that is broadcast at either layer 2 or layer 3, the router simply drops the frame. That's why routers are said to be the boundary of broadcast domains.
Some examples of these would be:
ff-ff-ff-ff-ff-ff (layer 2 broadcast)255.255.255.255 (layer 3 limited broadcast)
Thinking about it, this makes sense. If routers forwarded broadcasts a single arp request would reach every single reachable host on the internet which would be terribly inefficient and rather silly.
Directed broadcasts on the other hand are sometimes routed. (I.E. 192.168.1.255/24) Normally by default this functionality is disabled but can be enabled by issuing the ip directed-broadcast command on the router. This will allow it to forward directed broadcasts according to its routing table as if they were normal packets. This does not however allow the router to forward limited broadcasts, those are still blocked by default. This is also slightly off topic as to your original question, see this cisco forms page for more on this.
Layer 3 Broadcast But not Layer 2?
To answer your second question, it would make no sense to have a frame with a layer 3 broadcast address without a layer 2 broadcast address. This would defeat the entire purpose of it being a broadcast frame and just not work outright. Having a unicast layer 2 destination address would not change the router's behavior at all since the router makes its decisions at layer 3. All the router cares about is that 255.255.255.255 destination address and drops the packet.
Where this would matter is with switches which don't care about the layer 3 address at all. The switches would only see the unicast layer 2 address. Instead of sending the packet out all interfaces on the same vlan it would use the source address table (SAT) like it would with any other unicast destination address. In effect, by assigning a unicast layer 2 address the frame is no longer a broadcast frame at all even though it has the 255.255.255.255 address at layer 3.
How DHCP Relay Works in Practice
As for your last question, DHCP relay is a router's way of "cheating" around the rule about not forwarding broadcast packets. Let's look at a DHCP Discover packet:
- Source MAC: [unicast mac of the source]
- Dest MAC:
ff-ff-ff-ff-ff-ff
- Source IP:
0.0.0.0
- Destination IP:
255.255.255.255
- Source Port: UDP 68
- Destination Port: UDP 67
When the router sees a packet arrive on an interface with the ip helper-address command configured it checks to see is it matches any of the protocols that are "helped" by default or configured with the global ip forward-protocol command. In this case because it's DHCP the router sees that the destination port matches UDP 67 and allows the packet to be "helped". The router then changes the destination IP address from 255.255.255.255 to the IP address configured by the ip helper-address command as well as changing the source address to the address of the router interface on which the packet arrived and passes the packet along to the rest of the routing logic.
Now that the packet has a unicast destination address the router treats it like any other packet. It arps for the destination IP address (which is now that helper address) and then replaces the layer 2 addresses before sending the packet out the appropriate interface.
Getting Back Again
The router uses essentially the same process in reverse for the DHCP offer that is sent back to the client. The DHCP servers sends the offer to the IP address that was specified as the source address on the DHCP Discover packet. So the packet leaving the DHCP server looks like:
- Source MAC: unicast mac of the DHCP server
- Dest MAC: mac address of the router or the DHCP server's default gateway
- Source IP: unicast IP address of the DHCP server
- Destination IP: ip address of the first router interface that the DHCP Discover packet reached
- Source Port: UDP 67
- Destination Port: UDP 68
Since this packet has a unicast layer 3 destination address routers will forward the packet normally until it reaches the router with an interface that has an IP address matching the destination IP of the packet. Remember from earlier that this router has the ip helper-address configuration on that interface still. The router checks if the packet is a DHCP Offer then rewrites the packet to become a broadcast packet and sends it back out that interface knowing that the DHCP client is somewhere on that network segment. The packet leaving the router now looks like this.
- Source MAC: unicast mac of the router interface
- Dest MAC:
ff-ff-ff-ff-ff-ff
- Source IP: unicast IP address of the DHCP server
- Destination IP:
255.255.255.255
- Source Port: UDP 67
- Destination Port: UDP 68
TL:DR; DHCP relay using the ip helper-address interface subcommand "cheats" around the rule that routers cannot forward limited broadcasts by changing the packet's destination IP address to the unicast IP address of the DHCP server before routing it. This allows all routers down the line to route the packet appropriately to the DHCP server. When replying the DHCP server sends the packet back to the unicast IP address of the router interface that first received the DHCP Discover packet (the one with the ip helper-interface command). When the router receives the offer back it converts it back to a broadcast packet and sends it out the interface with the client in its broadcast domain.
Best Answer
As well as the IP addressing, covered already by other answer, you have to consider the level 2 behaviour. What makes a packet broadcast is really whether it is sent to "all hosts within range". I'm speaking about the mechanism by which the signal actually arrives on the hosts. In the case of a broadcast medium such as radio, coax, or hub, it just goes to all hosts by the property of the medium.
But in the typical deployment of twisted-pair ethernet, the intervening switches need to see the destination broadcast address ff:ff:ff:ff:ff:ff to forward to all ports. (Same would be true of most bridges.)
Additionally, once the frame arrives on the target nodes, most interfaces do ethernet address filtering themselves. So unless the incoming frame is for this interface or the broadcast, it won't be sent off the interface to the CPU for processing by the IP layer, which decides if this packet is for this host.
It's up to the detail of the OS and its configuration to know whether such directed broadcast IP addresses are actually broadcast at L2. (Ie, at the stage of deciding whether to look in ARP cache for the ether address.) As far as I am aware, all modern OS will correctly L2-broadcast the L3-directed broadcast address. But I've certainly seen older ones which do not.
And clearly, if the packet arrives via a router, it's the router which decides whether to broadcast it, or more usually, throw it away.