最近在研究DHCP服务器的offer与ack阶段是单播还是广播，终于在rfc2131里找到了答案，找到真相，还是要从英文文档那里着手，原文如下（请注意红色字体）： 

A client that cannot receive unicast IP datagrams until its protocol software has been configured with an IP address SHOULD set the BROADCAST bit in the 'flags' field to 1 in any DHCPDISCOVER or DHCPREQUEST messages that client sends. The BROADCAST bit will provide a hint to the DHCP server and BOOTP relay agent to broadcast any messages to the client on the client's subnet. A client that can receive unicast IP datagrams before its protocol software has been configured SHOULD clear the BROADCAST bit to 0. The BOOTP clarifications document discusses the ramifications of the use of the BROADCAST bit [21].

A server or relay agent sending or relaying a DHCP message directly to a DHCP client (i.e., not to a relay agent specified in the 'giaddr' field) SHOULD examine the BROADCAST bit in the 'flags' field. If this bit is set to 1, the DHCP message SHOULD be sent as an IP broadcast using an IP broadcast address (preferably 0xffffffff) as the IP destination address and the link-layer broadcast address as the link-layer destination address. If the BROADCAST bit is cleared to 0, the message SHOULD be sent as an IP unicast to the IP address specified in the 'yiaddr' field and the link-layer address specified in the 'chaddr' field. If unicasting is not possible, the message MAY be sent as an IP broadcast using an IP broadcast address (preferably 0xffffffff) as the IP destination address and the link- layer broadcast address as the link-layer destination address.

--from rfc2131

Read more: http://www.faqs.org/rfcs/rfc2131.html#ixzz0rO3BaRDw

（1） 根据上面所说，原来DHCP服务器的offer与ack阶段既可以使用单播的方式又可以使用广播的方式，这主要取决于服务器在offer阶段对BROADCAST位的置位情况,如果置位为1，则DHCP服务器使用广播的方式回应，否则使用单播的方式回应。无图无真相，马上上图证明这一结论。

(物理机xp与tp-link路由器：offer与ack阶段使用单播方式)

（2）再看看此过程offer阶段的BROADCAST的置位情况，如下图：

（3）接下来再看看，本机的虚拟网卡vnet1与dynamips下模拟的cisco路由器的DHCP过程，如下图：

(物理机xp的虚拟网卡vnet1与cisco3620路由器：offer与ack阶段使用广播方式)

（4）再看看此过程offer阶段的BROADCAST的置位情况，如下图：

结论：DHCP服务器的offer与ack阶段既可以使用单播的方式又可以使用广播的方式，这主要取决于服务器在offer阶段对BROADCAST位的置位情况,如果置位为1，则DHCP服务器使用广播的方式回应，否则使用单播的方式回应。