portnox/portnox-dhcp repository overview

Portnox SaaS DHCP Listener provides vendor-agnostic IoT Fingerprinting through DHCP options contained within client DHCP requests. However, in some environments, UDP Port 67 may be blocked by the Internet Service Provider (ISP) preventing DHCP request packets from being forwarded directly to the Portnox SaaS DHCP listener. This is especially common for internet services that do not provide customers with static IP address space or allow customers to utilize their own IP address block registered through a regional Internet registry (RIR).

In instances where UDP Port 67 is blocked and cannot be opened outbound through firewall policy or access control lists, Portnox provides this optional DHCP Forwarder as a Docker container that can be easily deployed on-prem or in public cloud services for agentless IoT Fingerprinting.

The Portnox DHCP Forwarder container listens for broadcast DHCP requests made on the same subnet as the Docker host. The container also listens on UDP Port 67 for any unicast DHCP requests sent via another DHCP forwarder within the environment. When received, these requests are forwarded on to Portnox SaaS-based DHCP listener on alternate UDP port 167.

The Portnox on-prem DHCP Listener is provided as a Docker Container, allowing it to be deployed in a wide variety of environments. The container utilizes few resources, consuming less than 1% CPU time on average and less than 25MB of RAM in most environments.

The Docker container is available for both Intel/AMD64 processors, as well as ARM64 processors, allowing the Portnox DHCP Forwarder to be run on such low-cost devices as the Raspberry Pi.

Deploy Portnox DHCP Forwarder can be downloaded by executing the following command on the Docker host.

                 docker pull portnox/portnox-dhcp

Once the docker image is downloaded, run the following command to start the container. Ensure you replace $IP with the IP address of the region your Portnox Cloud instance is running. If you are running with international geo-redundancy, enter the IP address of the geo closest to where the docker host is running. The IP addresses for each geo can be found within the Portnox cloud web console under [Settings > SaaS DHCP Listener IPs]

                 docker run -d --read-only --net=host --name portnox-dhcp-relay portnox/portnox-dhcp -i eth0 -r $IP:167

To verify the container is receiving and forwarding DHCP requests, view the logs on the container.

                 docker logs portnox-dhcp-relay -f

An entry will be generated for each DHCP request received by the Portnox DHCP Forwarder, and another entry logged when the request is forwarded to the Portnox SaaS DHCP Listener.

2022-12-20 22:20:27.323 INFO {"client":"0.0.0.0:68","event":"request","hostname":"mycomputer","message":"dhcp-discover","requested-ip address":"","source":"eth0","txid":"80:7d:3a:3e:02:07/abcd008f"} 2022-12-20 22:20:27.323 INFO {"event":"relay-send","message":"dhcp-discover","relay":"24.68.32.27:167","txid":"80:7d:3a:3e:02:07/abcd008f"}