DHCP

Four broadcasts: Discover, Offer, Request, Ack. The address comes with a lease: renewed halfway through, freed if not. The same answer sets the default gateway and the resolver, so whoever answers DHCP decides where a device sends its traffic and its questions.

How DHCP works, step by step

A laptop joins a network knowing nothing: no address, no gateway, no DNS server. It cannot ask anyone directly, so it broadcasts. DHCP (RFC 2131) runs over UDP, the client on port 68 and the server on port 67, in four messages known as DORA:

1. Discover. From 0.0.0.0 to 255.255.255.255. The packet carries the client's MAC address (chaddr), a random transaction id (xid) to match answers to questions, and option 55, the list of things it wants: subnet mask (1), router (3), DNS servers (6), domain name (15) and more.
2. Offer. Each server that has an address to give answers with it in yiaddr ("your address"), plus its own address as the server identifier (option 54), the lease time (51) and the options asked for.
3. Request. The client picks one offer and broadcasts a Request naming that server (option 54) and the address (option 50). It is a broadcast on purpose: any other server that made an offer learns it was not chosen and puts its address back.
4. ACK. The chosen server confirms. Only now does the client configure the address, the default route and the resolver. A server that cannot honour the request answers NAK, and the client starts again.

The address is a lease. At T1, half the lease (option 58), the client sends a Request straight to its server to renew: no Discover, no broadcast. If that server stays silent until T2, 87.5% of the lease (option 59), the client broadcasts the Request to any server. At the end of the lease, unrenewed, the address is gone. A client that leaves politely sends a Release.

A DHCP server answers only its own broadcast domain. For other networks, a router acts as a relay: it forwards the broadcast as unicast to the server and fills in giaddr so the server knows which pool to offer from.

What it looks like on a Linux machine

In the DHCP lab a dnsmasq server at 10.0.1.10 hands out 120-second leases. Its log shows one full DORA for the laptop:

dnsmasq-dhcp: DHCPDISCOVER(eth0) 9e:3b:52:c1:07:4a
dnsmasq-dhcp: DHCPOFFER(eth0) 10.0.1.11 9e:3b:52:c1:07:4a
dnsmasq-dhcp: DHCPREQUEST(eth0) 10.0.1.11 9e:3b:52:c1:07:4a
dnsmasq-dhcp: DHCPACK(eth0) 10.0.1.11 9e:3b:52:c1:07:4a

On the client, the default route remembers where it came from:

$ ip route
default via 10.0.1.2 dev eth0 proto dhcp
10.0.1.0/24 dev eth0 proto kernel scope link src 10.0.1.11

To see what a server offers without taking it, nmap sends one Discover from a made-up MAC and prints the Offer:

$ nmap --script broadcast-dhcp-discover -e eth0
|     IP Offered: 10.0.1.213
|     DHCP Message Type: DHCPOFFER
|     Server Identifier: 10.0.1.10
|     IP Address Lease Time: 2m00s
|     Renewal Time Value: 1m00s
|     Rebinding Time Value: 1m45s
|     Subnet Mask: 255.255.255.0
|     Domain Name Server: 10.0.1.2
|_    Router: 10.0.1.2

tcpdump -n -v port 67 or port 68 shows the same packets with every option decoded.

What goes wrong, and how you see it

No server answers. The client repeats broadcasting discover and never gets an address. Many systems then give themselves a link-local address from 169.254.0.0/16 (RFC 3927; Windows calls it APIPA). That address reaches nothing beyond the wire: no gateway, no DNS. A 169.254.x.x address on a machine that should have a real one means DHCP failed: the server is down, the port is in the wrong VLAN, or a relay is missing.

The server goes away while you hold a lease. Nothing happens until the lease runs out. Renewals fail quietly and the address keeps working, which is why a dead DHCP server is often noticed hours later, by the next machine to join.

The pool runs dry. Every address is leased, new clients get no Offer. An attacker can do it on purpose with thousands of made-up MAC addresses: the DHCP starvation lab.

A second server answers. The client takes the first Offer it gets. A rogue server, by accident or on purpose, hands out its own gateway and DNS server, and with them all the traffic. The rogue DHCP lab shows it, and switches stop it with DHCP snooping.

Questions people ask

Why does my device get the same address every time? Servers remember leases by MAC address or client id, and offer the same address back when it is free. A reservation pins it for good.

Does DHCP use TCP or UDP? UDP, ports 67 and 68, because a client with no address cannot open a connection.

What is the difference between DHCP and a static address? Nothing on the wire. A static address is the same address, mask, gateway and DNS server typed in by hand; servers and printers keep one so their names stay right.

See it on real machines