Role of DHCP Options in UEFI PXE Boot

Network booting a UEFI client relies heavily on Dynamic Host Configuration Protocol (DHCP) options to bridge the gap between initial hardware power-on and loading the operating system. In a Preboot Execution Environment (PXE), DHCP does far more than assign basic IP addresses; it acts as a traffic director by identifying the client's firmware architecture, pointing it to the correct boot server, and specifying the exact UEFI executable required to begin the installation or imaging process.

Architecture Identification via Option 93

UEFI systems fundamentally differ from legacy BIOS machines because they require 32-bit, 64-bit, or ARM-specific EFI binaries rather than traditional bootstrap code. When a UEFI device initiates a network boot, it sends a DHCPDISCOVER packet containing DHCP Option 93 (Client System Architecture).

Option 93 supplies a numerical value that identifies the client platform:

  • 0000: Legacy BIOS
  • 0006: x86 UEFI
  • 0007: x64 UEFI
  • 0009: EBC (EFI Byte Code)
  • 0011: ARM 64-bit UEFI

By reading Option 93, a configured DHCP server can dynamically distinguish a 64-bit UEFI client from a legacy BIOS machine and deliver the appropriate boot file accordingly.

Identifying the PXE Environment with Option 60

DHCP Option 60 (Vendor Class Identifier) informs the client whether a dedicated PXE service is co-located with the DHCP server or hosted elsewhere. When the UEFI firmware broadcasts its request, it includes Option 60 set to a string such as PXEClient:Arch:00007:UNDI:003016. If the DHCP server also acts as the PXE boot server, it responds with Option 60 set to PXEClient, instructing the machine to listen for boot parameters on port 4011.

Boot Server Redirection Using Option 66

Once the client accepts an IP address, it must locate the server hosting the bootloader, typically transferred via TFTP or HTTP. DHCP Option 66 (Boot Server Host Name) delivers the IP address or fully qualified domain name (FQDN) of this target boot server (often configured alongside the next-server field in standard DHCP server definitions). Without Option 66, the UEFI client attempts to retrieve the boot file directly from the DHCP server itself, which fails in networks where DHCP and image deployment services are separated.

Delivering the Boot File with Option 67

DHCP Option 67 (Bootfile Name) specifies the exact file path and name of the network boot program (NBP) on the boot server. Because UEFI firmware cannot interpret standard BIOS Master Boot Record (MBR) code, Option 67 must point directly to a valid EFI application:

  • For Windows deployments: Common paths include \boot\x64\wdsmgfw.efi or \boot\x64\bootmgfw.efi.
  • For Linux deployments: Typical paths include grubx64.efi or shimx64.efi.

When combined with Option 93 policies, Option 67 ensures that a 64-bit UEFI machine receives an .efi binary rather than a legacy file like pxelinux.0, preventing boot failure.

HTTP Booting via Option 160 and Option 67

Modern UEFI specifications (UEFI 2.5 and later) support downloading boot files over HTTP rather than TFTP, significantly improving transfer speeds and reliability over high-latency networks. In an HTTP boot workflow, DHCP Option 67 can carry a full URL (such as http://192.168.1.50/boot/bootx64.efi), or Option 160 can supply the base server URL. The UEFI network stack interprets this URL and initiates a standard HTTP GET request directly to the specified web service to download its startup payload.