[Kea-users] Client Classification using DHCP6 Relayed Vendor Options

Fri May 1 10:12:20 UTC 2026

Hi Peter,

I have no experience with DHCPv6 and cable modems, but you may be able
to do something like this:
hexstring(elay6[0].option[17].option[1026].hex, ':') but that may not
work since that is a vendor encapsulated sub-option. The vendor id is
in there somewhere.  Actually, I think this is very unlikely to work.
You could open an issue here:
https://gitlab.isc.org/isc-projects/kea/-/issues requesting that this
functionality be added.

And, you are correct that vendor is not supported there:

DHCP6_CONFIG_LOAD_FAIL configuration error using file: kea-dhcp6.json,
reason: expression:
[hexstring(relay6[0].vendor[4491].option[1026].hex, ':')] error:
<string>:1.21-26: syntax error, unexpected vendor, expecting option or
peeraddr or linkaddr at (kea-dhcp6.json:6:26)
DHCP6_INIT_FAIL failed to initialize Kea server: configuration error
using file 'kea-dhcp6.json': expression:
[hexstring(relay6[0].vendor[4491].option[1026].hex, ':')] error:
<string>:1.21-26: syntax error, unexpected vendor, expecting option or
peeraddr or linkaddr at (kea-dhcp6.json:6:26)

Thank you,
Darren Ankney

On Tue, Apr 21, 2026 at 1:05 AM Peter Nixon <listuser at peternixon.net> wrote:
>
> Hello Kea Users
>
> I'm new to this list, so in introduction, I'm a longtime open-source and network engineering type with plenty of experience with other ISC software as well as occasional patch contributions to open source software that I use regularly. I'm new to Kea, but have been building internet infrastructure including DNS, DHCP and AAA for decades so I hope that I'm not about to ask a dumb question.
>
> I'm attempting to do client classification (as well as forensic logging) of CableLab DOCSIS options being inserted by a DHCP6 Relay and struggling to get it to work the way that it feels that it should. In short I want to both limit the number of IP allowed per Cable Modem as well as log the Cable Modem (in addition to the CPE) MAC address into the forensic log.
>
> I'm receiving SOLICIT messages similar to the following (I've snipped some hopefully unnecessary detail) from a Cisco CMTS acting as a DHCP Relay:
>
> msg_type=SOLICIT (1), trans_id=0x341c2f,
>
> options:
>
>   type=00001, len=00010: 00:03:00:01:0c:02:27:c0:70:42
>
>   type=00003(IA_NA), len=00012: iaid=666923074, t1=0, t2=0
>
>   type=00006, len=00010: 17(uint16) 23(uint16) 24(uint16) 25(uint16) 82(uint16)
>
>   type=00008, len=00002: 0 (uint16)
>
>   type=00014, len=00000: ''
>
>   type=16, len=18,  enterprise id=0xde9, data-len0=12, vendor-class-data0='dslforum.org'
>
>   type=00017, len=00159: 4491 (uint32),
>
> options:
>
>     type=00001, len=00002: 1027(uint16)
>
>     type=00002, len=00007: "EROUTER" (string)
>
>     --snip--
>
>     type=00009, len=00008: 45:50:43:33:39:34:30:4c 'EPC3940L'
>
>     type=00010, len=00005: "Cisco" (string)
>
>     type=00036, len=00006: 0c:02:27:c0:70:42
>
>   type=00020, len=00000: ''
>
>   type=00025(IA_PD), len=00041: iaid=935358530, t1=151200, t2=302400,
>
> options:
>
>     type=00026(IAPREFIX), len=00025: prefix=::/56, preferred-lft=0, valid-lft=0
>
> 1 relay(s):
>
> relay[0]: msg-type=12(RELAY_FORWARD), hop-count=0,
>
> link-address=2--snip--00::1, peer-address=fe80::e02:27ff:fec0:7042, 3 option(s)
>
> type=00017, len=00022: 4491 (uint32),
>
> options:
>
>   type=01025, len=00004: 01:02:03:01
>
>   type=01026, len=00006: 0c:02:27:c0:70:3e
>
> type=00018, len=00028: 42:75:--snip--
>
> type=00079, len=00008: 00:01:0c:02:27:c0:70:42
>
>
>
> Here is what I "think" that I want to do, but it throws a syntax error as vendor doesn't seem to be allowed under relay6:
>
>   "template-test": "hexstring(relay6[0].vendor[4491].option[1026].hex, ':')"
>
>
> The crufy approach that I've gotten working is instead to grub around in the relayed vendor options with substring, but this would clearly break if the Relay decided to send any additional options for some reason:
>
>
>   "template-test": "hexstring(substring(relay6[0].option[17].hex,-6,6), ':')"
>
>
> Here are the relevant bits of config that in more complete form:
>
>
> "option-def": [
>
>     {
>
>         "name": "cl-cm-mac",
>
>         "code": 1026,
>
>         "type": "string",
>
>         "space": "vendor-4491"
>
>     }
>
> ],
>
> "client-classes": [
>
>   {
>
>       "name": "DOCSIS_CM",
>
>       "test": "vendor[4491].option[1026].exists",
>
>       "only-if-required": false
>
>   },
>
>   {
>
>     "name": "individual-cpe6_VOPT36",
>
>     "template-test": "hexstring(vendor[4491].option[36].hex, ':')",  // This detects the CPE MAC just fine from the first set of Vendor options
>
>     "user-context": {
>
>       "limits": {
>
>         "address-limit": 2
>
>       }
>
>     }
>
>   },
>
>   {
>
>     "name": "individual-cable-modem6v1",
>
>     "template-test": "hexstring(vendor[4491].option[1026].hex, ':')",  // This doesn’t match anything as Option[1026] is in the second Vendor block under relay_forward
>
>     "user-context": {
>
>       "limits": {
>
>         "address-limit": 10
>
>       }
>
>     }
>
>   },
>
>   {
>
>     "name": "individual-cable-modem6v2",
>
>     // "template-test": "hexstring(relay6[0].vendor[4491].option[1026].hex, ':')",  // syntax error
>
>     "template-test": "hexstring(substring(relay6[0].option[17].hex,-6,6), ':')", // works but a bit crufty!
>
>     "user-context": {
>
>       "limits": {
>
>         "address-limit": 10
>
>       }
>
>     }
>
>   }
>
> ]
>
>
> I would be very happy to have missed something obvious and would appreciate any help I can get :-)
>
> Thanks in advance!
>
> --
> Peter Nixon
> http://peternixon.net/
>
> Normal people believe that if it ain't broke, don't fix it. Engineers believe that if it ain't broke, it doesn't have enough features yet - Scott Adams
> --
> ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.
>
> To unsubscribe visit https://lists.isc.org/mailman/listinfo/kea-users.
> Kea-users at lists.isc.org