DHCP OFFER is a layer3 broadcast because the server doesn't know the client's IP, but the server knows the client's MAC address. So why does it send the OFFER as L2 broadcast?
If anyone ask me about this - how should I answer? Can I say its layer3 broadcast and layer2 unicast?
Be aware of the broadcast flag, see RFC2131 (page 24):
A client that cannot receive unicast IP datagrams until its protocol software has been configured with an IP address SHOULD set the BROADCAST bit in the 'flags' field to 1 in any DHCPDISCOVER or DHCPREQUEST messages that client sends. The BROADCAST bit will provide a hint to the DHCP server and BOOTP relay agent to broadcast any messages to the client on the client's subnet.
EDIT
A client that can receive unicast IP datagrams before its protocol software has been configured SHOULD clear the BROADCAST bit to 0. The BOOTP clarifications document discusses the ramifications of the use of the BROADCAST bit.
Added the rest of the RFC. According to the entire paragraph, it could be either broadcast, or unicast or even both.
The answer is that it can be either broadcast or unicast - and in some cases both unicast and broadcast before it reaches the client when an ip helper-address is used.
A client doesn't actually have an IP address until the DISCOVER-OFFER-REQUEST-ACK exchange is completed. It is possible (although very unlikely) to have a situation arise where the server will resond to the REQUEST with a NAK.
However, since unicast is generally preferred over broadcast, many clients will accept a unicast reply that matches their L2 address.
https://www.ietf.org/rfc/rfc2131.txt
As per this RFC:
Droms Standards Track [Page 24] RFC 2131 Dynamic Host Configuration Protocol March 1997
Normally, DHCP servers and BOOTP relay agents attempt to deliver DHCPOFFER, DHCPACK and DHCPNAK messages directly to the client using uicast delivery. The IP destination address (in the IP header) is set to the DHCP 'yiaddr' address and the link-layer destination address is set to the DHCP 'chaddr' address. Unfortunately, some client implementations are unable to receive such unicast IP datagrams until the implementation has been configured with a valid IP address (leading to a deadlock in which the client's IP address cannot be delivered until the client has been configured with an IP address).
A client that cannot receive unicast IP datagrams until its protocol software has been configured with an IP address SHOULD set the BROADCAST bit in the 'flags' field to 1 in any DHCPDISCOVER or DHCPREQUEST messages that client sends. The BROADCAST bit will provide a hint to the DHCP server and BOOTP relay agent to broadcast any messages to the client on the client's subnet. A client that can receive unicast IP datagrams before its protocol software has been configured SHOULD clear the BROADCAST bit to 0. The BOOTP clarifications document discusses the ramifications of the use of the BROADCAST bit [21].
A server or relay agent sending or relaying a DHCP message directly to a DHCP client (i.e., not to a relay agent specified in the 'giaddr' field) SHOULD examine the BROADCAST bit in the 'flags' field. If this bit is set to 1, the DHCP message SHOULD be sent as an IP broadcast using an IP broadcast address (preferably 0xffffffff) as the IP destination address and the link-layer broadcast address as the link-layer destination address. If the BROADCAST bit is cleared to 0, the message SHOULD be sent as an IP unicast to the IP address specified in the 'yiaddr' field and the link-layer address specified in the 'chaddr' field. If unicasting is not possible, the message MAY be sent as an IP broadcast using an IP broadcast address (preferably 0xffffffff) as the IP destination address and the link- layer broadcast address as the link-layer destination address.
A DHCP server is answering with a DHCP OFFER to provide an IP address. It knows the target MAC and IP, hence will use a unicast IP packet, toward the originating Ethernet address, hence a unicast Ethernet frame too.
If you want to see it for real, just enter the following command on your DHCP server:
tcpdump -imy_ethernet_device-e src port bootps
where my_ethernet_device is the name of the Ethernet interface on which your DHCP server is replying to your network.
tcpdump (or a wireshark) and conclude for yourself how it is really working.
The DHCP server may be present outside your network and thus we need to broadcast on Network layer as well.
The server responds with either a broadcast or a unicast message using UDP source port number 67 and destination port number 68. The response can be unicast because the server knows the IP address of the client. It also knows the physical address of the client, which means it does not need the services of ARP for logical to physical address mapping. However, some systems do not allow the bypassing of ARP, resulting in the use of the broadcast address.
Desktop or laptop or server or any other endpoint connecting to network through wireless or wired intiàtes DHCP discover message to DHCP server within data segment layer in osi model with destination Mac address as FF:FF:FF:FF:FF:FF
Frame with this DISCOVER message after reaches the DHCP Server .
After the DHCP Server gets discover message from client DHCP server responds suggesting the IP address available offering to the client host by unicast message frame as source address as DHCP server Mac address and destination address as clients Mac address .
Note : DHCP server knows client Mac address from DHCP client discover message This offer message contains .
proposed IP address for client for example 172.16.2.16 subnet mask to identify the subnet space for example 255.255.255.0 IP of default gateway for subnet for example 172.16.2.1 Internal dns server ip address if hosted, other wise external dns address will be used as configured on DHCP pool .
So finally we can conclude DHCP offer message is unicast from DHCP server
In my point of view, RFC2131 is clear on this: If you - as sender of the DHCPDISCOVER - set the broadcastflag to true, the DHCPOFFER is sent to you as broadcast on L3 AND L2!!
RFC2131, chap 4.1:
If this bit is set to 1, the DHCP message SHOULD be sent as an IP broadcast using an IP broadcast address (preferably 0xffffffff) as the IP destination address and the link-layer broadcast address as the link-layer destination address.
If the BROADCAST bit is cleared to 0, the message SHOULD be sent as an IP unicast to the IP address specified in the 'yiaddr' field and the link-layer address specified in the 'chaddr' field.
Unfortunately, there are quite some DHCP server implementation that use IP broadcast and (wrongly) Ethernet unicast.
