[usovalx]

May dhcp client/servers are using raw sockets and will thus bypass incorrect firewall config/martian packet filtering.

[schoen]

Yes, I forgot about that but you're right that that's the typical implementation method.

So the DHCP case does not necessarily need any special kernel support (other than not prefiltering before the raw socket).

Thanks for the correction.