RFC 3495

Dynamic Host Configuration Protocol (DHCP) Option for CableLabs Client Configuration

📅 published March 2003, from ietf

RFC 3495 💖 Dynamic Host Configuration Protocol (DHCP) Option for CableLabs Client Configuration

okay bestie, here's the vibe check ✨ This doc is from the Network Working Group and it's a Standards Track document dated March 2003 🌸 The authors are B. Beser from Juniper Networks and P. Duffy, Ed. from Cisco Systems (the "Ed." just means editor, so P. Duffy is the one who wrangled the whole thing 💅). The title block doesn't list anything this RFC obsoletes or updates, so it's standing on its own 🦋

Status of this Memo 📜

okay so this document is an Internet standards track protocol for the Internet community, and it's literally asking for discussion and suggestions for improvements 🫶 If you want to know where this protocol stands in the official standardization state, check the current edition of "Internet Official Protocol Standards" (STD 1). And the good news is that distribution of this memo is unlimited 🎀

Copyright Notice ©️

Abstract 🍓

this doc defines a Dynamic Host Configuration Protocol (DHCP) option that's used to configure different devices in CableLabs architectures 🔥 It zooms in on one kind of CableLabs client: the PacketCable Media Terminal Adapter (MTA) 📞 The option content defined here is going to keep growing as future CableLabs client devices get built ✨

Table of Contents 🗂️

1.  Conventions used in this document............................  2
2.  Terminology..................................................  2
3.  Introduction.................................................  3
4.  CableLabs Client Configuration Option Format.................  4
5.  CableLabs Client Configuration Option: Sub-Option Definitions  5
    5.1.  TSP's DHCP Server Address Sub-Options..................  5
    5.2.  TSP's Provisioning Server Address Sub-Option...........  6
    5.3.  TSP's AS-REQ/AS-REP Backoff and Retry..................  6
    5.4.  TSP's AP-REQ/AP-REP Backoff and Retry..................  7
    5.5.  TSP's Kerberos Realm Name Sub-Option...................  8
    5.6.  TSP's Ticket Granting Server Utilization Sub-Option....  8
    5.7.  TSP's Provisioning Timer Sub-Option....................  8
6.  Informational Description of CCC Option Usage................  9
7.  IANA Considerations..........................................  9
8.  Legacy Use Information.......................................  9
9.  Procedure for Adding Additional Sub-options..................  9
10. Security Considerations...................................... 10
11. References................................................... 10
    11.1. Normative References................................... 10
    11.2. Informative References................................. 11
12. Acknowledgments.............................................. 11
13. Authors' Addresses........................................... 12
14. Full Copyright Statement..................................... 13

1. Conventions used in this document 🧠

the BCP 14 key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" are the ones to pay attention to in this document 👀 They're to be read the way BCP 14, RFC 2119 [1] describes 💅

2. Terminology 📚

here are the terms used all throughout this doc:

"Telephony Service Provider" or "TSP" 📞 This is the business entity a subscriber gets telephony service from ✨

For more DHCP terms, see RFC 2131 [6] 💖

3. Introduction 🌸

so Cable Television Laboratories, Inc. (CableLabs) is a non-profit research and development consortium 🧚 It serves the cable TV industry by designing and specifying new and emerging broadband service architectures 🔥 A bunch of CableLabs initiatives define DHCP clients with their own special DHCP configuration needs, and one of the big ones is PacketCable 📞

The PacketCable project is all about architecting, qualifying, and supporting Internet-based multimedia services over cable-based packet networks 🌈 These new services include telephony and videoconferencing, delivered over the basic Internet Protocol (IP) technology that sends data across the Internet 💜

PacketCable 1.0 delivers Voice over IP (VoIP) service 📞 At the customer site, the VoIP service is powered by two key pieces: a Cable Modem (CM) and a Media Terminal Adapter (MTA) 🎀 The CM turns cable RF signals into and out of various IP voice protocols, and the MTA turns those VoIP protocols into analog telephony that works with a regular phone ☎️✨

The CM and MTA can come packaged together or separately 🦋 Packaged together, the unit is called an Embedded-MTA (EMTA), which you can see in Figure 1 🫶 Packaged separately, the MTA is called a Standalone MTA (SMTA) 💅

          |----------------------------------------------|
          |                                              |
          |   |-----------|           |-------------|    |
          |   |           |           |             |    |
Telephony |   |  Media    | internal  |   Cable     |    | RF Link
----------|---| Terminal  |===========|   Modem     |----|-------
Link      |   | Adapter   | connection|             |    |
          |   |-----------|           |-------------|    |
          |                                              |
          |----------------------------------------------|

               Figure 1. PacketCable 1.0 Embedded-MTA

the CM and MTA are two separate IP devices, and each one has its own MAC address and IP configuration 🔥 Both of them use DHCP to get their IP configuration 💖 It's assumed that different business entities might administer the CM and the MTA 👑 The CM talks to and gets configured by the Data Access Provider's (DAP's) DHCP servers 🧚 The MTA talks to and gets configured by the Telephony Service Provider's (TSP's) DHCP servers 📞

The PacketCable architecture requires that the business entity controlling the CM's configuration also decides which business entities control the MTA's configuration 🫶 It's kind of like the PSTN: people can pick their long distance carrier, but their phone is still ultimately controlled by the local carrier 🌸

because the MTA configuration process has specific needs (described in [7]), a new CableLabs Client Configuration (CCC) option is needed for DHCP 🎀 Both CM and MTA DHCP clients will request this option 💜 When it's requested, both the DAP and TSP DHCP servers will fill this option into DHCP responses 🦋 Check out section 6 for more operational details ✨

it's worth noting that even though the CCC option is first getting deployed to support PacketCable VOIP applications, it'll also be used for various non-VoIP applications 🌈 Using the CCC option doesn't automatically mean the service provider is a TSP 💅

4. CableLabs Client Configuration Option Format 🧩

the option starts with a tag octet holding the option code, which is 122 🔥 A length octet comes right after the tag octet 💖 The length octet's value doesn't count itself or the tag octet 🌸 After the length octet come "length" octets of sub-option content (that's the total length, not the number of sub-options) 🧚 Here's the layout:

   +------+--------+--------------+--------------+---+--------------+
   | 122  | Length | Sub-option 1 | Sub-option 2 |...| Sub-option n |
   +------+--------+--------------+--------------+---+--------------+

when the total length of a CCC option goes over 255 octets, the procedure in [4] MUST be used to split the option into multiple, smaller options 💀 That's a must-do, no cap 🫶

a sub-option starts with a tag octet holding the sub-option code 🎀 A length octet follows the tag octet, and its value doesn't count itself or the tag octet 💜 After it come "length" octets of sub-option information 🦋 Here's that layout:

   +-------------------+--------+------------------------+
   | Sub-option Code   | Length | Sub-option information |
   +-------------------+--------+------------------------+

here are the sub-option codes, summed up in one table 🍓

   +---------+---------+--------------------------------------------+
   |  Sub-   | Sent to | Description                                |
   | option  |         |                                            |
   |  Code   |         |                                            |
   +===================+============================================+
   |    1    |  CM     | TSP's Primary DHCP Server Address          |
   +---------+---------+--------------------------------------------+
   |    2    |  CM     | TSP's Secondary DHCP Server Address        |
   +---------+---------+--------------------------------------------+
   |    3    |  MTA    | TSP's Provisioning Server Address          |
   +---------+---------+--------------------------------------------+
   |    4    |  MTA    | TSP's AS-REQ/AS-REP Backoff and Retry      |
   +---------+---------+--------------------------------------------+
   |    5    |  MTA    | TSP's AP-REQ/AP-REP Backoff and Retry      |
   +---------+---------+--------------------------------------------+
   |    6    |  MTA    | TSP's Kerberos Realm Name                  |
   +---------+---------+--------------------------------------------+
   |    7    |  MTA    | TSP's Ticket Granting Server Utilization   |
   +---------+---------+--------------------------------------------+
   |    8    |  MTA    | TSP's Provisioning Timer Value             |
   +---------+---------+--------------------------------------------+
   | 9 - 255 |         | Reserved for future extensions             |
   +---------+---------+--------------------------------------------+

5. CableLabs Client Configuration Option: Sub-Option Definitions 🔍

the next sections dig into each sub-option in detail 🎀 Before that, here are a few general formatting rules you need to know 👑

Fully Qualified Domain Names (FQDNs) MUST be encoded per RFC 1035 [3] section 3.1 💅 Note that a terminating 0 is required 🧚 Also, compression (described in RFC 1035 [3] section 4.1.4) MUST NOT be applied 🙈
IPv4 addresses MUST be encoded as 4 binary octets in network byte-order (high order byte first) 🌈
All multi-octet quantities MUST be encoded per network byte-ordering ✨

5.1. TSP's DHCP Server Address Sub-Options 📡

the TSP DHCP Server Address sub-options identify the DHCP servers an MTA is allowed to accept a DHCP OFFER from 🫶 Sub-option 1 is the address of the TSP's primary DHCP server 💖 Sub-option 2 is the address of the TSP's secondary DHCP server 🦋

the sub-option length MUST be 4, and the sub-option MUST include the DHCP server's IPv4 address, laid out like this 🔥

     Code  Len          Address
   +-----+-----+-----+-----+-----+-----+
   | 1/2 |  4  |  a1 |  a2 |  a3 |  a4 |
   +-----+-----+-----+-----+-----+-----+

5.2. TSP's Provisioning Server Address Sub-Option ✨

Okay so this sub-option carries the address of the TSP's Provisioning server 📡. MTAs talk to the Provisioning server at different stages of their provisioning process, so this one is a big deal bestie 💖

The address can be either an IPv4 address or an FQDN 🌐 The encoding of sub-option 3 comes in one of 2 formats.

IPv4 address. The sub-option length MUST be 5. The length octet MUST be followed by a single octet that tells you which address type comes next. This type octet MUST be set to 1 to mean IPv4 address. The type octet MUST be followed by 4 octets of IPv4 address:

 Code   Len   Type        Address
+-----+-----+-----+-----+-----+-----+-----+
|  3  |  5  |  1  |  a1 |  a2 |  a3 |  a4 |
+-----+-----+-----+-----+-----+-----+-----+

FQDN. The length octet MUST be followed by a single octet that tells you which address type comes next. This type octet MUST be set to 0 to mean FQDN. The type octet MUST be followed by the encoded FQDN:

 Code   Len   Type            FQDN
+-----+-----+-----+-----+-----+   +-----+
|  3  | n+1 |  0  |  f1 |  f2 |...|  fn |
+-----+-----+-----+-----+-----+   +-----+

It's not expected that any type codes beyond IPv4 (1) and FQDN (0) will be needed 🙅‍♀️ So IANA won't be required to keep a registry of type codes. Simple and iconic 💅

5.3. TSP's AS-REQ/AS-REP Backoff and Retry ⏱️

This sub-option sets up an MTA's Kerberos AS-REQ/AS-REP timeout, backoff, and retry mechanism. It's giving "how long do I wait before I try again" energy 🫶

RFC 1510 [5] doesn't define a backoff/retry mechanism for when an AS-REQ/AS-REP message exchange fails 😭 So this sub-option carries the parameters needed by the backoff/retry mechanism outlined in [8]. Gap filled ✨

Here's how it's laid out:

   Code Len   Nom Timeout     Max Timeout     Max Retries
   +---+---+---+---+---+---+---+---+---+---+---+---+---+---+
   | 4 |12 |n1 |n2 |n3 |n4 |m1 |m2 |m3 |m4 |r1 |r2 |r3 |r4 |
   +---+---+---+---+---+---+---+---+---+---+---+---+---+---+

The length octet of this sub-option MUST contain the value 12. 🔢

The length octet MUST be followed by 4 octets holding the AS-REQ/AS-REP nominal (initial) timeout value. This value is a 32 bit unsigned quantity in units of milliseconds. ⚡

The next 4 octets MUST contain the AS-REQ/AS-REP maximum timeout value. This value is a 32 bit unsigned quantity in units of seconds. ⏰

The final 4 octets MUST contain the AS-REQ/AS-REP maximum retry count. This value is a 32 bit unsigned quantity. 🔁

5.4. TSP's AP-REQ/AP-REP Backoff and Retry 🌸

Same vibe as the last one, just for the AP-REQ/AP-REP side 🦋 This sub-option sets up an MTA's Kerberos AP-REQ/AP-REP timeout, backoff, and retry mechanism.

Again, RFC 1510 [5] doesn't define a backoff/retry mechanism for when an AP-REQ/AP-REP message exchange fails. This sub-option carries the parameters needed by the backoff/retry mechanism outlined in [8] 💖

The encoding looks like this:

   Code Len   Nom Timeout     Max Timeout     Max Retries
   +---+---+---+---+---+---+---+---+---+---+---+---+---+---+
   | 5 |12 |n1 |n2 |n3 |n4 |m1 |m2 |m3 |m4 |r1 |r2 |r3 |r4 |
   +---+---+---+---+---+---+---+---+---+---+---+---+---+---+

The length octet of this sub-option MUST contain the value 12. 🔢

The length octet MUST be followed by 4 octets holding the AP-REQ/AP-REP nominal (initial) timeout value. This value is a 32 bit unsigned quantity in units of seconds. ⏳

The next 4 octets MUST contain the AP-REQ/AP-REP maximum timeout value. This value is a 32 bit unsigned quantity in units of seconds. ⏰

The final 4 octets MUST contain the AP-REQ/AP-REP maximum retry count. This value is a 32 bit unsigned quantity. 🔁

5.5. TSP's Kerberos Realm Name Sub-Option 👑

Okay so the PacketCable architecture requires an MTA to authenticate itself to the TSP's network using the Kerberos protocol 🔐 A Kerberos Realm name is needed at the MTA so it can do a DNS lookup for the address of the TSP's Kerberos Key Distribution Center (KDC) entity. Lookup energy 🕵️‍♀️

The Kerberos Realm name MUST be encoded per the domain style realm name described in RFC 1510 [5]. This realm name MUST be all capital letters and MUST conform to the syntax described in RFC 1035 [3] section 3.1. Loud and proud, all caps only 📢 The sub-option is encoded like this:

    Code   Len   Kerberos Realm Name
   +-----+-----+-----+-----+   +-----+
   |  6  |  n  |  k1 |  k2 |...|  kn |
   +-----+-----+-----+-----+   +-----+

5.6. TSP's Ticket Granting Server Utilization Sub-Option 🎟️

This sub-option encodes a boolean value that says whether an MTA should or should not use a TGT (Ticket Granting Ticket) when getting a service ticket for one of the PacketCable application servers 🍓 The encoding goes like this:

    Code   Len   Value
   +-----+-----+-----+
   |  7  |  1  | 1/0 |
   +-----+-----+-----+

The length MUST be 1. The last octet contains a Boolean value which MUST be either 0 or 1. A value of 1 MUST be interpreted as true. ✅ A value of 0 MUST be interpreted as false. ❌ Binary but make it iconic 💀

5.7. TSP's Provisioning Timer Sub-Option ⏲️

The provisioning timer sets the maximum time allowed for the MTA provisioning process to finish 🏁 If this timer runs out before the MTA has finished provisioning, the MTA should reset the timer and restart its provisioning process from the beginning. Fresh start hour 🧚

The sub-option length MUST be 1. The value octet specifies 0 to 255 minutes. A value of 0 means the timer MUST be disabled. 🙈

    Code   Len    Value
   +-----+-----+---------+
   |  8  |  1  | (0..255)|
   +-----+-----+---------+

6. Informational Description of CCC Option Usage. 🌈

Cablelabs client devices send DHCP requests that include DHCP options 55 (Parameter Request List) and 60 (Vendor Class Identifier) 📨 Option 55 asks the DHCP server for the CCC option. Option 60 tells the server which specific Cablelabs client device type is asking, so the server knows which CCC sub-option content to fill into its responses 🧠 The details of which CCC sub-options get filled in for each client type are in various Cablelabs project specifications. For example, the specific way the CCC option is used for the PacketCable project is described in [7] 📚

Note that client devices never populate the CCC option in their DHCP requests. 🙅‍♀️ They only ask for it, they never fill it in themselves!

7. IANA Considerations 🏷️

IANA has assigned a value of 122 for the DHCP option code described in this document 🎉 Number 122, bestie, remember it 💜

8. Legacy Use Information 🕰️

The CableLabs Client Configuration option originally used the site-specific option value of 177 (0xB1) 🦋 Site-specific use is being deprecated now that IANA has issued an official option number. Glow-up era ✨

9. Procedure for Adding Additional Sub-options 🧩

IANA is asked to maintain a new number space called "CableLabs Client Configuration Sub-options", located in the BOOTP-DHCP Parameters Registry (http://www.iana.org/assignments/bootp-dhcp-parameters) 📋 The initial sub-option codes are described in section 4 of this document.

IANA is asked to register codes for future CableLabs Client Configuration Sub-options via an "IETF Consensus" approval policy, as described in RFC 2434 [2] 🤝 Future-proofing is the whole vibe.

10. Security Considerations 🚨

Okay this one is serious, bestie 😭 Potential exposures to attack in the DHCP protocol are discussed in section 7 of the DHCP protocol specification [6] and in Authentication for DHCP Messages [9] 🔒

The CCC option can be used to misdirect network traffic by giving a Cablelabs client device incorrect DHCP server addresses, incorrect provisioning server addresses, and incorrect Kerberos realm names 🫣 That misdirection can lead to several threat scenarios. A Denial of Service (DoS) attack can happen when address information is simply invalid 💀 A man-in-the-middle attack can be set up by handing out addresses to a potential snooper 👀 And a malicious TSP can steal customers from the customer-selected TSP by changing the Kerberos realm designation. Villain arc, fr fr 😤

These threats are mitigated by several factors. 🛡️

Within the cable delivery architecture required by PacketCable, the DHCP client connects to a network through a cable modem and the CMTS (head-end) 📡 The CMTS is explicitly configured with a set of DHCP servers that DHCP requests are forwarded to. Also, a correctly configured CMTS will only allow downstream traffic from specific IP addresses/ranges 🧱

Say server addresses and the Kerberos realm name were successfully spoofed, to the point where a malicious client device was able to contact a KDC. The client device must still present valid certificates to the KDC before being service enabled. Because certificate validation is computationally expensive, this situation could present a DoS opportunity 😬

Finally, it's possible for a malicious (although certified) TSP to redirect a customer away from the customer's selected TSP. It is assumed that all TSPs permitted onto an access provider's network are trusted entities that will cooperate to ensure peaceful coexistence 🫶 If a TSP is found to be redirecting customers, this should be handled as an administrative matter between the access provider and the TSP. Drama handled by the adults 🧑‍⚖️

11. References 📖

11.1. Normative References

[1] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. 🔑

[2] Narten, N. and H. Alvestrand, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 2434, October 1998. 📝

[3] Mockapetris, P., "Domain Names - Implementation and Specification", STD 13, RFC 1035, November 1987. 🌐

[4] Lemon, T. and S. Cheshire, "Encoding Long Options in the Dynamic Host Configuration Protocol (DHCPv4)", RFC 3396, November 2002. 🧵

[5] Kohl, J. and C. Neuman, "The Kerberos Network Authentication Service (V5)", RFC 1510, September 1993. 🔐

[6] Droms, R., "Dynamic Host Configuration Protocol", RFC 2131, March 1997. 🏠

11.2. Informative References

[7] "PacketCable MTA Device Provisioning Specification", PKT-SP-PROV-I05-021127. http://www.packetcable.com/specifications.html 📗

[8] "PacketCable Security Specification", PKT-SP-SEC-I07-021127, http://www.packetcable.com/specifications.html 📘

[9] Droms, R. and W. Arbaugh, "Authentication for DHCP Messages", RFC 3118, June 2001 🔏

12. Acknowledgments 💖

The authors would like to extend a heartfelt thanks to everyone who helped develop the PacketCable Provisioning specifications 🫶 Squad goals, honestly:

Sumanth Channabasappa (Alopa Networks); Angela Lyda, Rick Morris, Rodney Osborne (Arris Interactive); Steven Bellovin and Chris Melle (AT&T); Eugene Nechamkin (Broadcom); John Berg, Maria Stachelek, Matt Osman (CableLabs); Klaus Hermanns, Azita Kia, Michael Thomas, Paul Duffy (Cisco); Deepak Patil (Com21); Jeff Ollis, Rick Vetter (General Instrument/Motorola); Roger Loots, David Walters (Lucent); Peter Bates (Telcordia); Patrick Meehan (Tellabs); Satish Kumar, Itay Sherman, Roy Spitzer (Telogy/TI), Aviv Goren (Terayon); Prithivraj Narayanan (Wipro). 🌟

The authors would also like to give a special "thank you" to Rich Woundy (Comcast) for his thoughtful inputs 🎀

13. Authors' Addresses 💌

Burcak Beser, Juniper Networks, 1194 North Matilda Avenue, Sunnyvale, CA, 94089
EMail: burcak@juniper.net
Paul Duffy, Cisco Systems, 300 Apollo Drive, Chelmsford, MA, 01824
EMail: paduffy@cisco.com

14. Full Copyright Statement ✨

okay so bestie, this part is the legal bit, but it's still giving main character energy 💅 The Internet Society owns the copyright (2003), and it's all reserved, but you're still allowed to do a lot with this stuff. 🦋

You can copy it and share it with others, and you can make derivative works that comment on or explain it or help people implement it. You can publish and distribute those too, in whole or in part, with no restriction at all 🫶 BUT you have to keep the copyright notice and this paragraph on every copy and every derivative work, no skipping. 😭

The one thing you can't do is modify the document itself. Like, you can't remove the copyright notice or the references to the Internet Society or other Internet organizations, periodt 🙈 The exceptions are when you're developing Internet standards (then the Internet Standards process copyright procedures have to be followed 📜) or when you need to translate it into languages other than English 🌍

The permissions are perpetual, so the Internet Society and its successors or assigns can't take them back 💜

And the document, plus all the info in it, is provided "AS IS" 🎀 THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, incl. no guarantee that using the info won't infringe any rights, and no implied warranties of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Not it being sus, just the legal vibes 💀

Acknowledgement 🌸

Funding for the RFC Editor function is currently provided by the Internet Society. 🍓

📦 where this page comes from

ietf: rfc3495 2003-03
💖 girlified by claude-haiku-5-5 on 2026-10-16: a language model's rewrite of the original, under its terms