The DHCP relay Docker container (portnox-dhcp)

In this topic, you will learn what the portnox-dhcp Docker container does, its requirements, how to deploy it, and how its update behavior works.

Overview

Portnox Cloud IoT fingerprinting relies on a DHCP forwarder that relays client DHCP requests from your local network to Portnox Cloud. This can be done with a Layer 3 device, such as a router, that supports DHCP forwarding. Some routers do not support acting as a DHCP forwarder while also being the DHCP server for the network, so if yours does not, the portnox-dhcp Docker container is a software alternative.

The container is also useful in a second, unrelated scenario. Normally, client DHCP requests are relayed to Portnox Cloud over UDP port 67, but some ISPs or firewalls block that port outbound. In that case, this container relays requests over UDP port 167 instead, which is less commonly blocked, regardless of whether your router can act as a forwarder.

The DHCP relay is available in the public Docker repository as portnox/portnox-dhcp. It has no virtual machine equivalent.

For an overview of how IoT fingerprinting and MAC spoofing protection work, and to decide whether you need this container at all, see Turn on MAC address spoofing protection by IoT fingerprinting.
If you use Cisco Catalyst switches or wireless LAN controllers, you may be able to use IoT fingerprinting without deploying this container at all, by enabling DHCP gleaning instead. See DHCP Gleaning.
If you have a Layer 3 device that supports DHCP forwarding alongside its existing role, you can use that instead of this container. See Set up the DHCP forwarder for details on both options.

Requirements

The container is lightweight. It typically uses less than 1% CPU and less than 25 MB of RAM. It is available for both Intel/AMD64 and ARM64 processors.
The container must run with host networking (--net=host), so it can receive DHCP broadcast traffic directly from the local subnet. DHCP broadcasts do not cross Docker's virtual bridge network, so without host networking the container would never see them. Host networking is supported on Linux Docker hosts only, so this container cannot be deployed using Docker Desktop on Windows or macOS. The Docker host running the container must be on the same subnet as the devices you want to fingerprint.
Follow the firewall rules in How to set up the firewall for Portnox Docker containers to connect to Portnox Cloud exactly, including the section specific to portnox-dhcp. The container may not work correctly if any of those rules are missing.

Deployment

Pull the portnox-dhcp Docker image.
```
sudo docker pull portnox/portnox-dhcp
```

Run the container, replacing the IP address with the Portnox Cloud IoT fingerprinting server for your region.

sudo docker run -d --read-only --net=host \
  --name portnox-dhcp-relay portnox/portnox-dhcp:latest \
  -i interface -r ip_address:167

Where ip_address is:

United States: 20.241.131.45
Europe: 20.4.128.229

For example:

sudo docker run -d --read-only --net=host \
  --name portnox-dhcp-relay portnox/portnox-dhcp:latest \
  -i eth0 -r 20.241.131.45:167

Optional: Monitor the container’s logs to confirm it is receiving and forwarding DHCP requests.
```
sudo docker logs portnox-dhcp-relay -f
```

Troubleshooting

To collect Docker container logs for troubleshooting, see How to collect Portnox Docker container logs for support.
To test whether the container’s outbound UDP packets are reaching Portnox Cloud, see Test the forwarder connection.

Updates

The container does not update automatically, unless you also use the autoupdate container. Updating requires recreating the Docker container, so there may be a short service interruption.