Now that we know what DHCP relay agents are, we will find out another DHCP agent, a DHCP proxy agent today. 

What a DHCP relay agent does is simply relay broadcast DHCP packets (DHCP Discover/Request) to DHCP server(s) located in other subnets whenever it receives packets from a DHCP client residing in that same subnet. On the other hand, a DHCP proxy agent not only relays the DHCP packets between subnets, but also acts on behalf of a DHCP server, while also acting as a DHCP client.

That is, it acts as a DHCP server to the DHCP client, but act as a DHCP client to the DHCP server. 

The following figure shows a comparison between the DHCP relay agent and the DHCP proxy agent.    

The DHCP relay agent simply relays only the broadcast packets used in IP address allocation/lease procedures while the DHCP proxy agent, performing the functions of both a DHCP server and client, relays from one to the other all DHCP packets (Broadcast or Unicast) used in IP address allocation (lease), IP address renewal and IP address release procedures.

Then what are the benefits of using a DHCP proxy agent instead of a DHCP relay agent?

• Because the IP address of a DHCP server is not viewable to users (DHCP clients), the DHCP server is protected from external attacks, such as Denial of Service (DoS), which targets the server (DHCP clients can only see the IP address of a DHCP proxy agent).
• Because the DHCP proxy agent keeps a list of all user IP addresses allocated through DHCP messages, it can create an IP-to-MAC binding table based on the information. This allows the agent to block any traffic from unauthorized users whose IP addresses have not been allocated through DHCP procedures (i.e. static IP users). Actually, we “Netmanias”, have once applied such security function to a network operated by one of our customers (a Dutch telecom operator) by enabling a DHCP proxy agent in Juniper BRAS when we provided the System Integration (SI) services. 

Why does a user recognize the IP address of a DHCP proxy agent as the IP address of a DHCP server?

• That’s because the proxy agent replaces the IP address of a DHCP server with the IP address of the DHCP proxy agent in the “DHCP Server Identifier (Option 54)” field before forwarding it to the user.