Does ip helper-address forward only DHCP?
Show the answer
Say this first
No. By default Cisco IOS forwards eight UDP broadcast services to every helper address: Time (37),
TACACS (49), DNS (53), BOOTP/DHCP server (67) and client (68), TFTP (69), NetBIOS name service (137)
and NetBIOS datagram service (138). I trim the list with no ip forward-protocol udp <port> and add
ports with ip forward-protocol udp <port>.
Go deeper
Why it matters
Every Windows host broadcasting NetBIOS on that VLAN gets relayed to the DHCP servers. It is noise at best. On a clean build I remove what I do not need. Some Cisco references also list the obsolete IEN-116 name service (UDP 42) among the defaults, so the eight is the commonly quoted set rather than a guarantee on every release.
no ip forward-protocol udp 37
no ip forward-protocol udp 49
no ip forward-protocol udp 137
no ip forward-protocol udp 138Adding a port
Wake-on-LAN magic packets are often sent to UDP 9. To relay them, add the port and point a helper at the directed broadcast of the target subnet:
ip forward-protocol udp 9
!
interface Vlan20
ip helper-address 10.30.0.255
!
interface Vlan30
ip address 10.30.0.1 255.255.255.0
ip directed-broadcast 110ip directed-broadcast 110 lets the router turn the packet into a layer 2 broadcast on VLAN 30,
only for traffic that access list 110 permits (for example the WoL server). Directed broadcasts are
off by default since IOS 12.0.
They will ask next
Why are directed broadcasts disabled by default?
Smurf attacks. An attacker pings a subnet's broadcast address with the victim's address as the source, and every host on that subnet replies to the victim. Turning the router into an amplifier is not something you want by default.
Does the helper forward unicast DHCP traffic too?
No. It catches UDP broadcasts arriving on that interface for the forwarded ports. Unicast renewals already go straight to the server by normal routing.
Traps
- Saying the helper is DHCP-only. Interviewers like the list of eight.
- Enabling
ip directed-broadcastwithout an access list on the target interface.