Across a Router

How a broadcast reaches a server it cannot possibly reach

Step 1 of 2 — understand the idea. Read this first and the packet trace will confirm what you already expect, instead of teaching you two things at once.

What you'll be able to do

▸Explain why a router must not forward a DHCP broadcast
▸Read giaddr and say which segment a relayed client is on
▸Say why a missing relay and a dead server look identical from the client

Before this lesson — it builds directly on:

You already know two things, and both of them are right. A DHCP client can only broadcast. It has no address, so it cannot send a normal packet and cannot receive one. Everything before the ACK goes to 255.255.255.255. A router does not forward broadcasts. That is what a broadcast domain IS — the set of machines a broadcast reaches, bounded by routers. If routers forwarded broadcasts, every broadcast on any segment would reach every machine on the network, and the whole idea of segmenting a network would collapse. Put those together and you get a problem. Client on one segment, server on another: the DISCOVER reaches the router and stops. Correctly. And yet almost no real network puts a DHCP server on every segment — you would need dozens of them, each with its own pool to keep in step. The answer is not to bend either rule. It is a third thing: a small piece of software on the router that listens for these particular broadcasts and repeats them as ordinary unicast traffic. That is a relay agent, and it is why one server can address a hundred segments.

Shouting in a room. Everyone in the room hears you, and the walls stop there. A relay agent is a receptionist who is in the room, hears the shout, walks to another building, and repeats it to the person who can actually answer — then comes back and announces the answer to the room.

the room: → the broadcast domain — one segment
the walls: → the router, which does not pass shouts through
the receptionist repeating it elsewhere: → the relay's unicast to the server
saying which room the question came from: → giaddr, the relay's address on the client's segment
announcing the answer back to the room: → the relay broadcasting the reply on that segment

Where it breaks down: A receptionist can decide who to ask. A relay cannot — it forwards to exactly the servers it is configured with, and if that address is wrong or unreachable the DISCOVER is dropped as silently as if the relay were not there. "No DHCP server" and "a relay pointed at the wrong address" look identical from the client.

✗ Common misunderstanding: The relay agent forwards the client's broadcast to the server.

Why that's wrong: It does not forward anything. Forwarding would mean the router passing a broadcast between segments, which is the one thing it must never do. The relay ORIGINATES a new packet, with its own source address, its own hop count, and giaddr filled in.

Correct model: The client's packet dies on the client's segment, exactly as it should. What reaches the server is a different packet, sent by the router, carrying the same DHCP message inside it.

The packets prove it: In this trace the client's DISCOVER leaves 10.0.1.x with source 0.0.0.0 to 255.255.255.255. The one that reaches the server has source 10.0.2.1 and destination 10.0.2.50 — a unicast the router sent, and there is no forwarding decision anywhere in the trace.

Watch these fields in the lab: dhcp.giaddr · dhcp.hops · ipv4.destIp

Relay agent: Software on a router that listens for DHCP broadcasts on one segment and repeats them as unicast to a server elsewhere — then puts the answers back on the segment they came from.
giaddr: The "gateway address" field, filled in by a relay with its own address on the client's segment. Zero means no relay was involved. It is both the return address for the reply and the server's only clue about which subnet the client is on.
hops: A counter incremented by each relay a message passes through. It bounds how far a message can travel if relays are ever chained or misconfigured into a loop — the same job TTL does for ordinary packets.
Scope: One subnet's worth of configuration on a DHCP server: a pool of addresses, a mask, a gateway. A server that answers several segments has one scope per segment and picks between them by reading giaddr.

Watch these fields in the lab: dhcp.giaddr · dhcp.hops

✓ Concept check — before you open the packets

These test the idea, not the trace. You should be able to answer them from the explanation above.

Why must the router NOT simply forward the client's broadcast to the other segment?

A server answers relayed clients on several subnets. How does it know which pool to use?

Now that you understand the concept, observe how it appears in the packet exchange.

The lab runs a real simulated capture — pause, step, click any packet, and inspect every byte.