portnox/portnox-dhcp repository overview

⁠Portnox DHCP relay

The portnox-dhcp container relays DHCP requests from your local network to Portnox Cloud. Portnox Cloud uses these requests for IoT fingerprinting, a way to identify devices and to detect MAC address spoofing. A device's DHCP request contains no sensitive information, only its MAC address and general capabilities, so relaying it does not expose anything about the device or its traffic.

You need this container in two cases. First, if you don't have a router or Layer 3 device that can act as a DHCP forwarder while also being your DHCP server, this container acts as that forwarder instead, listening for DHCP broadcasts on the local subnet and forwarding them to Portnox Cloud. Second, even if your router can act as a forwarder, some ISPs or firewalls block outbound UDP port 67, which forwarders normally use. This container talks to Portnox Cloud on UDP port 167 instead, which is blocked less often.

⁠Deploy

The container must run with host networking, since DHCP broadcasts do not cross Docker's virtual bridge network. The host running the container must be on the same subnet as the devices you want to fingerprint.

sudo docker run -d --read-only --net=host \
  --name portnox-dhcp-relay portnox/portnox-dhcp:latest \
  -i <interface> -r <ip_address>:167

Replace <interface> with your network interface (for example eth0), and <ip_address> with the Portnox Cloud IoT fingerprinting server for your region: 20.241.131.45 for the United States, or 20.4.128.229 for Europe.

⁠Updating

Update the container by redeploying it manually, or automate updates with the portnox-autoupdate container⁠.

⁠Full documentation

For full documentation, see: docs.portnox.com⁠.