DHCP: Getting an Address Automatically

Application Layer and Security · 25 min

Core CS · Computer Networks

You need an address to ask for an address

A host that has just joined a network has a MAC address and nothing else. It does not know its own IP address, its mask, its gateway or its DNS server, and it does not know which machine to ask. Four messages fix all of that, and every address written on them is forced by something the client does not yet know.

Step a new host through DORA, with every address on every packet
The first message goes out from 0.0.0.0 to 255.255.255.255, because the client has no address to send from and no idea who to ask. DISCOVER, OFFER, REQUEST and ACK follow, over UDP, with the server on port 67 and the client on port 68. Only after the ACK may the client use the address, and only until the lease runs out.

01 The idea

The two addresses that break the deadlock

Start from what a host actually needs before it can do anything useful on an IP network. It needs four things, not one, and an answer that names only the first loses marks. It needs an IP address of its own. It needs a subnet mask, so it can work out which destinations are on its own link and which have to go through a router. It needs the address of that router, the default gateway. And it needs the address of at least one DNS server, or it can reach machines by number and by nothing else. Type those four into every laptop, phone, printer and access point by hand and the network works, right up until somebody plugs in a device you have never met. A coffee shop or a lecture hall cannot be run that way at all.

So the host has to ask. And that is where the interesting problem starts, because asking means sending an IP packet, and every IP packet carries a source address and a destination address. The host has no source address, because being told one is the whole point of the exercise. It has no destination address either, because nothing has ever told it that a configuration server exists, let alone where it lives. Both fields of the very first packet are unknown at the moment the packet has to be built. That is the bootstrap problem, and everything else in this lesson is a consequence of it.

There are exactly two escapes, and IP provides both. The first is 0.0.0.0, the address that means I do not have one. It is legal in the source field of a packet sent by a host that is still unconfigured, and it is legal nowhere else. The second is 255.255.255.255, the limited broadcast address, which means every host on this link. Because the frame carrying it goes to the link-layer broadcast address ff:ff:ff:ff:ff:ff, every network card on the segment accepts it and passes it up. So the client can reach a server without knowing where the server is, by shouting at everyone.

That solves the outbound half. The return half is solved by something the host has had since it left the factory: its MAC address, the 48-bit identifier burned into the network card. The client writes its MAC into the message, and every reply carries it back along with a random transaction number the client invented. So even when the reply is broadcast to the whole segment, the client can pick out the one that is meant for it. Before it has an IP address, the client's identity is its MAC.

One more design decision is worth taking seriously before the messages themselves, because it explains the shape of everything after: what the server hands out is a lease, not a gift. Addresses are a finite pool. Devices leave a network constantly, and almost none of them announce that they are leaving; a laptop that is closed and carried out of the building tells nobody. If addresses were granted permanently the pool would drain and never refill, and somebody would have to go and clean it up by hand. A lease expires on its own, so the pool heals with no administrator involved. The cost of that is a renewal mechanism, which is where half the exam questions on this topic live.

A new host broadcasts from 0.0.0.0 to 255.255.255.255 because it has no address to send from and does not know who to ask. Four messages, DISCOVER, OFFER, REQUEST and ACK, hand it an address, a mask, a gateway and a DNS server, on loan for a fixed lease that it has to keep renewing.
Limited broadcast, 255.255.255.255Every host on the local link accepts a packet sent to it, and no router ever forwards it. The first half is what lets an unconfigured client find a server; the second half is why a server on a different subnet needs a relay agent, which is the single most common real-world complication.
LeaseA fixed interval, in seconds, during which the client may use the address. It is a loan. The client is expected to ask for an extension long before it runs out, and when it does run out the client must stop using the address and the server is free to give it to someone else.
chaddr and xidchaddr is the client hardware address field: the client's MAC, which is the only identity it has before it has an IP address. xid is a random 32-bit transaction ID the client puts in its first message and every reply echoes, so a client can tell which broadcast on the wire is an answer to its own question.

02 Worked example

One client, two servers, four messages

One scene, and it is the same scene for the rest of the lesson: the console in section 04 runs on it and every number in the cheat sheet is checked against it. The network is 192.168.1.0/24 with mask 255.255.255.0 and a router at 192.168.1.1. There are two DHCP servers on the segment, which is normal practice for redundancy: server A at 192.168.1.10 and server B at 192.168.1.11. A laptop with MAC 3c:22:fb:1a:2b:3c has just linked up and holds nothing else. Read left to right.

Nothing but a MACThe card is up and the link light is on. The laptop has 3c:22:fb:1a:2b:3c and no IP address, no mask, no gateway and no resolver. It cannot yet send a packet that anything would answer.
1. DISCOVER0.0.0.0 → 255.255.255.255, ports 68 → 67, frame to ff:ff:ff:ff:ff:ff. It carries the client MAC in chaddr and a random xid. Both servers and the router receive a copy.
2. OFFER, twiceA proposes 192.168.1.101 with a lease of 86400 s. B proposes 192.168.1.150 with 3600 s. Each carries mask, gateway and DNS. Neither has committed anything. Ports 67 → 68.
3. REQUEST, still broadcastStill from 0.0.0.0, still to 255.255.255.255. Option 54 names server A, option 50 names 192.168.1.101. This is the node worth justifying, and the one interviewers push on.
4. ACK, and only nowServer A writes the binding into its lease database and confirms: address, mask 255.255.255.0, gateway 192.168.1.1, DNS, lease 86400 s, T1 and T2. The client may now configure the address.

Four messages, and the striking thing is how little freedom there is in the addressing. On the DISCOVER, the source is 0.0.0.0 because there is no other value the client is entitled to write, and the destination is 255.255.255.255 because the client does not know that server A exists. On the OFFER, the source is the server's real address, and the destination is the broadcast address again: the client set the broadcast flag, the top bit of the two-byte flags field, to say do not unicast to me, my stack cannot yet accept a packet addressed to an IP address I do not own. The client finds its own reply among the broadcast traffic by matching the xid it invented and its own MAC in chaddr. A client whose stack can accept that unicast leaves the flag clear, and the server then sends the OFFER straight to the offered address and MAC. Both behaviours are legal; the flag is what decides.

Now the highlighted node, because why is the REQUEST broadcast is the follow-up you will get, and there are two reasons rather than one. The first is the same constraint as before: an offer is not a lease. Server A has set 192.168.1.101 aside, but the client does not own it and may not send from it, so the source address is still 0.0.0.0 and a unicast reply could not reach it anyway. The second reason is the one that earns the mark. Server B is also on this segment and is also holding an address aside. When the client broadcasts a REQUEST carrying option 54, the server identifier, set to 192.168.1.10, server B reads it, sees another server's identity, and puts 192.168.1.150 straight back in the pool. Had the REQUEST been unicast to server A, server B would have heard nothing and would have had to sit on that address until a timer expired. The broadcast is the message to the servers that lost.

It is worth being exact about when the address becomes usable, because this is where careless answers appear. Not after the OFFER. An OFFER is a proposal, and a client that has received two of them has not accepted either. The binding is written into the server's lease database when it sends the ACK, and only from that point does the address belong to this client. Even then a careful client does one more check first: it sends an ARP request asking who owns 192.168.1.101, and configures the address only if nothing answers. That guards against an address that somebody typed into a device by hand from inside the server's pool, which the server has no way to know about.

Finally, the two numbers that arrive with the lease and are asked about constantly. The lease here is 86400 seconds, so the timers work out as T1 = 0.5 × 86400 = 43200 s, which is 12 hours, and T2 = 0.875 × 86400 = 75600 s, which is 21 hours. Read those as a schedule for the client. At 12 hours it politely asks the server that issued the lease for an extension, by unicast, because by then it has an address of its own to send from and knows exactly who to ask. At 21 hours, if that has got no answer, it stops being polite and broadcasts to any server that will listen. At 24 hours, if that has also failed, the lease is over and the client must stop using 192.168.1.101 and start again at the DISCOVER. Three chances, and they crowd together toward the end on purpose.

03 Mechanics

The messages, the states and the options they carry

Three tables, in the order the questions come. First the messages with their addressing written out, including the two you send at renewal time, because what is different about a renewal is the follow-up that separates a memorised answer from an understood one. Note that DHCP itself is an application-layer protocol: it runs over UDP like any other application, and the only unusual thing about it is that it runs before its host has an address.

#MessageSenderSource → destination IPUDP portsWhat is inside that matters
1DISCOVERclient0.0.0.0 → 255.255.255.25568 → 67Option 53 = 1. chaddr is the client MAC, xid is random, option 55 lists the parameters it would like.
2OFFERserverserver IP → 255.255.255.25567 → 68Option 53 = 2. yiaddr is the proposed address, plus options 1 mask, 3 router, 6 DNS, 51 lease, 54 server identifier.
3REQUESTclient0.0.0.0 → 255.255.255.25568 → 67Option 53 = 3, option 54 naming the chosen server, option 50 naming the wanted address. ciaddr is still zero.
4ACKserverserver IP → 255.255.255.25567 → 68Option 53 = 5. The committed binding, the same parameters again, plus options 58 and 59 if T1 and T2 are being set explicitly.
Now the client is BOUND. The four above are only ever sent by a client that has no lease. Everything below happens to a client that already has one.
T1REQUEST then ACKclient, then its serverclient IP → server IP (unicast)68 → 67Option 53 = 3, ciaddr filled with the client's address, and options 50 and 54 deliberately absent. That absence is how the server knows this is a renewal.
T2REQUEST then ACKclient, then any serverclient IP → 255.255.255.25568 → 67The same message, broadcast. The client has given up on its own server and is asking whether anybody at all will extend this lease.
endRELEASE, or expiryclientclient IP → server IP (unicast)68 → 67A RELEASE hands the address back early and is optional. If the lease runs out on its own, the client sends nothing and goes back to the beginning with a DISCOVER.

Why UDP, and why it could not have been TCP. TCP would give reliability for free, and DHCP has to reinvent it with retransmission timers, so the choice looks wasteful until you try to make it. Opening a TCP connection needs a three-way handshake, a handshake needs segments, and a segment needs a source IP address and a destination IP address. The client has neither. TCP is not merely heavy here, it is unavailable: you cannot connect to a machine whose address you do not know, from an address you do not have. UDP asks for nothing. It is a header, a source port, a destination port and a payload, and it will happily carry a datagram from 0.0.0.0 to a broadcast address. Everything TCP would have given is rebuilt by hand: the client retransmits a DISCOVER after about 4 seconds, then 8, then 16, doubling to a cap of 64, with a second or so of randomisation so that a room full of machines powering up together does not retry in lockstep.

Why two fixed ports, 67 and 68, rather than an ephemeral one. The normal pattern is that a client picks a random high port, the server replies to it, and the reply lands on the socket that sent the request. That pattern fails here in both directions. Nothing has told the client which port a server listens on, so the destination port has to be a constant known in advance: 67, inherited from BOOTP in RFC 951. And the reply cannot go to an ephemeral port either, because it is a link-layer broadcast that every host on the segment receives, and on some machines the software that receives it is not even the software that sent the request, a bootstrap ROM having handed over to an operating system in between. So the client end is nailed down too, at 68. Keeping them separate has a second benefit: a server only ever listens on 67 and only ever sends to 68, so it never has to look at another server's broadcast replies, and a client never sees another client's requests.

Second table, the client's own state machine. An exam question here is nearly always which state is this host in or what moves it out of that state, and the two amber rows are the ones people confuse: one is left by a timer at half the lease, the other by a timer at seven eighths.

StateYou arrive here byYou leave when
INITThe interface came up, or the lease expired, or the client released it. No address at all.You broadcast a DISCOVER.
SELECTINGYour DISCOVER is out and you are collecting OFFERs.You choose one and broadcast a REQUEST naming its server in option 54.
REQUESTINGYour REQUEST is out and you are waiting for the commitment.An ACK arrives, or a NAK arrives and throws you back to INIT.
BOUNDThe ACK arrived, the address is configured, both timers are running.T1 fires at half the lease
RENEWINGT1 fired. You sent a unicast REQUEST to the server that issued the lease.an ACK returns you to BOUND, or T2 fires
REBINDINGT2 fired at seven eighths. You are broadcasting to any server that will answer.an ACK, or the lease expires and you go back to INIT
INIT-REBOOTYou rebooted and still remember an address you held before.You broadcast a REQUEST naming that address, skipping DISCOVER entirely. An ACK confirms it; a NAK sends you to INIT.

Read the difference between the two renewal rows out loud, because it is the most examinable line in the lesson. At T1, half the lease, the client already has an address and already knows which server issued it, so it sends a single unicast REQUEST straight there and gets a single unicast ACK back. Two messages, no DISCOVER, no OFFER, nothing broadcast, and no other server on the segment even learns that it happened. At T2, seven eighths, the polite route has failed, so the client falls back to shouting: the same REQUEST, but broadcast, because the specific server it wanted is evidently not answering and any server holding a record for this address will do. It still sends from its own address, because it still legitimately holds the lease. Only when the lease itself expires does the client lose the address and go all the way back to DORA.

Third table, the options. A DHCP message is a BOOTP message underneath: 236 bytes of fixed fields, then the four-byte magic cookie 99.130.83.99 that marks a message as DHCP rather than plain BOOTP, then a variable list of options. Almost everything DHCP actually delivers is an option, so the option numbers are fair game in a viva.

OptionNameAppears inWhat it does
53DHCP message typeevery messageThe one that makes the message what it is: 1 DISCOVER, 2 OFFER, 3 REQUEST, 4 DECLINE, 5 ACK, 6 NAK, 7 RELEASE, 8 INFORM.
1Subnet maskOFFER, ACKWhich destinations are on this link and which need the router.
3RouterOFFER, ACKThe default gateway. A list, in order of preference.
6Domain name serverOFFER, ACKThe resolvers the host will use for every name lookup it ever makes.
50Requested IP addressREQUEST, when selectingWhich offered address this REQUEST is accepting. Must not appear in a renewal.
51IP address lease timeOFFER, ACKThe whole lease, in seconds. T1 and T2 are derived from it unless 58 and 59 override them.
54Server identifierOFFER, ACK, REQUEST when selectingWhich server. This is what tells the losing servers to release the addresses they set aside.
58 / 59Renewal (T1) and rebinding (T2) timeOFFER, ACKExplicit timer values. Left out, they default to one half and seven eighths of option 51.
82Relay agent informationinserted by a relayWhich physical port and which VLAN the request arrived on, so the server can log or police it.
255Endevery messageMarks the end of the options field. Anything after it is padding.

The relay agent, for when the server is not on the segment. A limited broadcast to 255.255.255.255 dies at the first router, by design, which would mean one DHCP server per subnet in a building with forty VLANs. The fix is a relay agent, usually the router itself. It listens on port 67 on the client-facing interface, and when a DISCOVER arrives it does not forward it: a router may not forward a limited broadcast. It builds a new unicast packet of its own, copies the DHCP payload in, and writes its own interface address into the giaddr field, the gateway address. That single field does two jobs. It tells the server which subnet the client is on, so the server knows which pool to draw from, since by the time the packet arrives the source address is the relay's rather than the client's. And it is where the server sends the reply, which the relay then puts onto the client's segment. Watch the ports while that happens: relay to server and server back to relay both run 67 → 67, because a relay speaks to a server the way a server does, and only the last hop, from the relay down onto the client's segment, goes to port 68. On Cisco IOS the whole thing is one line on the VLAN interface, ip helper-address 10.99.0.5.

Reservations, and why they are not the same as a static address. Some devices have to be findable at a fixed address forever: a printer, a badge reader, a camera. There are two ways to arrange that and they are not equivalent. A reservation is configured on the DHCP server: bind this MAC address to this IP address, and hand out that address and nothing else whenever this MAC asks. The device is still a completely ordinary DHCP client and still does DORA, still renews, still gets its mask and gateway and DNS from the server, and if the gateway changes next year it picks the change up on its next renewal like everything else. A static address is typed into the device itself, which then never speaks DHCP at all, so the server has no idea the address is in use and will cheerfully offer it to somebody else unless you have also excluded it from the pool by hand. A device with a static address that still wants the other parameters can ask for them with a DHCPINFORM, which asks for options without asking for an address.

The two ways this goes wrong, and the messages that say so. If a client ARP-probes its new address and something answers, the address is already in use by a host the server does not know about. The client sends a DECLINE to tell the server that address is poisoned, the server marks it unusable, and the client starts again from DISCOVER. In the other direction, if a client asks for an address the server will not give it, typically after a laptop moves to a different subnet and tries an INIT-REBOOT with the address it remembers, the server answers with a NAK, and the client drops the address and returns to INIT. A NAK is a refusal, not an error: it is how a host that has been carried between buildings is told to stop assuming.

Nothing in any of this is authenticated. A client believes whichever OFFER it likes, and a server believes any MAC address that asks. So a laptop plugged into a wall socket, running a DHCP server that answers a little faster than the real one, can hand out a valid address with itself as the default gateway and as the DNS server, and every host that boots afterwards sends its traffic through the attacker and resolves its names with the attacker. DHCP cannot fix this from the inside, because the client has no identity to check a signature against until after it has been configured. The fix lives one layer down, on the switch.

05 Cheat sheet

What gets asked about DORA, and what gets answered wrong

Every row is something you can be asked to state in under ten seconds. The right-hand column is the specific wrong answer that gets written down, not a general caution.

What they askThe answerThe trap
The four messages, in orderDISCOVER, OFFER, REQUEST, ACKSaying "DORA" and then not being able to expand it, or swapping OFFER and REQUEST.
Transport and portsUDP · server 67, client 68TCP — a handshake needs an address the client does not have
Addressing on the DISCOVER0.0.0.0 → 255.255.255.255putting the server’s address in it — the client does not know it exists
What the client actually receivesaddress, mask, gateway, DNS, leaseNaming only the address. It is four settings plus the lease, not one.
Why the REQUEST is broadcastso the servers whose offers lost can free themSaying "because the client still has no address". True, but it is only half the answer.
When may the address be usedafter the ACK, never after the OFFERafter the OFFER — an offer is a proposal, the binding is written on the ACK
T1 and T2T1 = lease / 2 · T2 = 7/8 of the leaseT2 = 3/4 — it is seven eighths, and the two crowd together on purpose
How a renewal is addressedunicast to the leasing server, ciaddr filled, no option 50 or 54Broadcasting it, or repeating the whole DORA. A renewal is two messages.
What happens at T2the same REQUEST, but broadcast to any serverThinking the client has lost the address at T2. It keeps it until the lease actually expires.
Server on another subneta relay agent · giaddr · ip helper-addressa router forwards the broadcast — it never does; the relay originates a new unicast
Same address for a printer, every timea reservation on the server, keyed on the MACTyping a static address into the printer. The server then does not know the address is taken.
Nothing answers169.254.0.0/16, mask 255.255.0.0, link-local onlyexpecting internet access — there is no gateway and no DNS on a link-local address
DHCP for IPv6ports 546 client and 547 server · Solicit, Advertise, Request, Reply67 and 68 — DHCPv6 is a different protocol with different ports
Every address on a DISCOVER is forced0.0.0.0 because there is nothing else the client is entitled to write. 255.255.255.255 because it does not know a server exists. The MAC because it is the only identity the card has ever had. Not one of the three is a design preference, and saying why each is forced is what a good answer sounds like.
An offer is not a leaseTwo servers can offer at once and neither has committed anything. The binding is written when the ACK is sent. That is why the client still sends from 0.0.0.0 in the REQUEST, and why the REQUEST is broadcast: it is simultaneously an acceptance to one server and a refusal to all the others.
Renew is unicast, rebind is broadcastAt T1, half the lease, two messages go straight to the server that issued it and nothing else on the segment hears them. At T2, seven eighths, the same request is broadcast to anyone. At expiry the address is gone and the client starts at DISCOVER again. One timer, one addressing mode, one fallback.

06 Where & why

Where the lease shows up on a machine you can log into

None of this is a teaching abstraction. Every value in section 02 is printed by a command you can run today, and two of the four systems below are where the security note at the end of section 03 actually gets fixed.

Cisco IOS
One command relays it, another defends it

ip helper-address 10.99.0.5 on a VLAN interface makes the router a relay agent: it turns each client broadcast into a unicast to that server and writes its own interface address into giaddr. Worth knowing that the command forwards eight UDP services by default and not only DHCP, including TFTP 69, DNS 53, Time 37, TACACS 49 and the two NetBIOS ports 137 and 138. The other half is ip dhcp snooping: every access port starts untrusted, only the uplink towards the real server is marked ip dhcp snooping trust, and the switch drops any message that only a server is entitled to send when it arrives anywhere else. It also builds a table of MAC to IP to port, which Dynamic ARP Inspection and IP Source Guard then read.

ISC Kea
The pool, the reservation and the lease database

A subnet4 entry declares the range the server hands out and the options that ride with it; a reservation binds one hw-address to one address, so a printer keeps the same address forever without anything being typed into the printer. valid-lifetime is option 51, and renew-timer and rebind-timer are options 58 and 59 for when you want to override the one half and seven eighths defaults. The lease database is the authority on who holds what: an entry that no host is actually using is exactly what an expiry exists to clear. Kea is the supported successor to ISC dhcpd, which reached end of life in 2022, though it is dhcpd.conf syntax that most exam questions still show.

Linux ip addr
valid_lft is your lease, counting down

ip -4 addr show prints a DHCP-assigned address with the word dynamic on it and a valid_lft in seconds that is smaller every time you run the command. That number is option 51 as the kernel sees it, and watching it jump back up to the full lease is watching the renewal at T1 succeed on a real machine. ip route then shows the default route that came from option 3, and resolvectl status shows the resolvers that came from option 6. Three commands, three of the four things the ACK handed over, and the fourth is the mask sitting next to the address as a prefix length.

Windows ipconfig
The lease has two timestamps and a name

ipconfig /all prints DHCP Enabled, DHCP Server, Lease Obtained and Lease Expires, so the entire lease including the identity of the server that issued it is on one screen. ipconfig /release sends a RELEASE and hands the address back; ipconfig /renew restarts the exchange. This is also where most people first meet a link-local address without knowing what it is, because when nothing answers, the line reads Autoconfiguration IPv4 Address and the value starts 169.254.

Read the whole protocol as a sequence of things the client is not yet allowed to assume. It may not assume it has an address, so it sends from 0.0.0.0. It may not assume it knows a server, so it broadcasts. It may not assume an offer is a lease, so it waits for the ACK. It may not assume the address is free, so it ARP-probes it. It may not assume it can keep the address, so it renews. The one thing it is forced to assume, because there is no mechanism to check it, is that whoever answered was telling the truth, and that single unavoidable assumption is the whole of DHCP security.

07 Interview questions

The questions, and the follow up that catches people

DORA is easy to memorise and that is exactly the problem: almost everybody can list four words, so the marks are in the second question. Expect to be asked what address is written on a message, or why one of them is broadcast, or what is different about a renewal. Say the addresses out loud while you draw the exchange; a description with no 0.0.0.0 in it reads as recited.

What does DHCP do, and what exactly does it hand a client?
It configures a host automatically, and it hands over four things, not one: an IP address, a subnet mask so the host can tell local destinations from remote ones, a default gateway so it can reach anything off its own link, and one or more DNS servers so it can resolve names. All four arrive as options in the same message, together with a lease that says how long the address is valid. Answering with only the address is the most common way to lose half the marks on this question.
Walk me through DORA, and tell me what addresses are on each message.
The client broadcasts a DISCOVER from 0.0.0.0 to 255.255.255.255, ports 68 to 67, carrying its MAC in chaddr. Each server that hears it replies with an OFFER from its own address, proposing an address in yiaddr with a mask, gateway, DNS and lease attached. The client broadcasts a REQUEST, still from 0.0.0.0, naming the server it chose in option 54 and the address it wants in option 50. That server replies with an ACK, and only then is the address the client’s to use.
The client has no IP address. So how does the DISCOVER get anywhere, and how does the reply get back?
Two special addresses make it possible. 0.0.0.0 is the legal source address for a host that has not been configured yet, so there is something to put in the field. 255.255.255.255 is the limited broadcast address, and because the frame carrying it goes to ff:ff:ff:ff:ff:ff, every host on the segment receives it, including any DHCP server, without the client knowing where the server is. The reply gets back because the client’s MAC address travels in the message and comes back in every response, along with a random transaction ID it invented, so it can recognise its own answer even when that answer is broadcast to everyone.
Why does DHCP run over UDP rather than TCP, and why are the ports fixed at 67 and 68?
TCP is not merely heavy here, it is unavailable: opening a connection needs a handshake, a handshake needs segments, and a segment needs a source and a destination IP address, neither of which the client has. UDP will carry a datagram from 0.0.0.0 to a broadcast address without asking for anything. The ports are fixed because neither end can be told a port in advance: nothing has told the client where a server listens, so 67 has to be a constant, and the reply is a broadcast that every host receives rather than something landing on the socket that sent the request, so the client end is fixed at 68 too. Keeping them separate also means a server never has to process another server’s broadcast replies.
Why is the REQUEST broadcast when the client already knows which server it wants?
For two reasons and you want both. The client still does not own the offered address, so it still has to send from 0.0.0.0 and could not receive a unicast reply anyway. More interestingly, the broadcast is how the servers that lost find out. It carries option 54 naming the chosen server, so any other server that had set an address aside reads that, sees a different identifier, and returns its address to the pool immediately instead of holding it until a timer expires. The REQUEST is an acceptance to one server and a refusal to all the others in a single message.
At what point may the client start using the address?
After the ACK, never after the OFFER. An offer is a proposal; the server has only tentatively set the address aside and the client has not accepted it, which is why a client that received two offers has not taken either. The binding is written into the server’s lease database when it sends the ACK, and only from then does the address belong to that client. A careful client does one more thing first: it sends an ARP request for the address to check that no host has it configured by hand, because an address typed into a device is invisible to the server.
Explain the lease, and what happens at T1 and T2.
The address is a loan for a fixed number of seconds, carried in option 51, so that addresses come back on their own when devices leave without saying so. T1 defaults to half the lease: the client sends a single REQUEST as a unicast straight to the server that issued the lease, with its own address in ciaddr, and gets an ACK back. Two messages, no DISCOVER. T2 defaults to seven eighths: the polite route has failed, so the client broadcasts the same request to any server that will answer. If that also fails, the lease expires, the client must stop using the address and it goes back to the beginning with a DISCOVER.
The DHCP server is on a different subnet from the clients. How does that work at all?
It works through a relay agent, normally the router on the client’s own segment. A limited broadcast is never forwarded by a router, so the relay does not forward anything: it builds a fresh unicast packet addressed to the server, copies the DHCP payload into it, and fills in the giaddr field with its own interface address on the client’s subnet. That field is what tells the server which pool to draw from, because by the time the packet arrives the source address is the relay’s, and it is also where the server sends the reply for the relay to deliver onward. On Cisco kit it is one line, ip helper-address on the VLAN interface.
A laptop shows 169.254.23.87. What happened, and what will still work?
No DHCP server answered. After retransmitting its DISCOVER several times with the wait doubling from about 4 seconds, the host gave up and self-assigned a link-local address from 169.254.0.0/16 with mask 255.255.0.0, checking with an ARP probe that nobody else had picked the same one. Windows calls this APIPA; the standard is RFC 3927. What still works is traffic to other hosts on the same link, which is why two laptops on a cable can talk with no server anywhere. What does not work is everything else, because there is no default gateway and no DNS server. The real fault is upstream: the server, the relay agent, the VLAN, or the cable.
Is DHCP authenticated? What can somebody on the same LAN do with it?
It is not. Nothing authenticates the server to the client or the client to the server; RFC 3118 defined a mechanism and it is essentially never deployed. So a laptop running a DHCP server on a wall port can answer a DISCOVER before the real server does and hand out a perfectly valid address with itself as the default gateway and as the DNS server, which puts it in the middle of everything that host does afterwards. The mirror-image attack is starvation: ask for addresses with thousands of forged MAC addresses until the pool is empty and genuine hosts are refused. Neither is fixable inside DHCP, because the client has no identity to verify anything against until after it has been configured. Both are handled on the switch, with DHCP snooping and with port security.

08 Practice problems

Six to work on paper

Draw the segment before you answer any of these: the client, the servers, the router, and an arrow for every message with its source and destination written on it. Four of the six turn on the difference between a client that owns an address and one that does not, and one of them is decided entirely by arithmetic you can do in your head.

Three instants on one clock

Easy
A client receives its ACK at exactly 09:00:00 with a lease of 5400 seconds and no options 58 or 59. Give the wall-clock time at which it first tries to renew, the wall-clock time at which it starts rebinding, and the wall-clock time at which it must stop using the address.
Follow-up
The three instants are not evenly spaced. Work out the gaps between them as well as the times themselves, and say in one line why the protocol crowds the last two together instead of spreading all three evenly.
Show the hint
Work entirely in seconds from the ACK and convert to clock time only at the very end. Seven eighths of the lease is measured from the ACK, not from whatever was left after the first timer fired.

Five packets, and some of them cannot exist

Easy
For each of these five, say whether it is possible and give one sentence of reason if it is not. (a) DISCOVER, 0.0.0.0 → 255.255.255.255, ports 68 to 67. (b) OFFER, 192.168.1.10 → 255.255.255.255, ports 68 to 67. (c) REQUEST, 192.168.1.101 → 192.168.1.10, ports 68 to 67. (d) ACK, 192.168.1.10 → 255.255.255.255, ports 68 to 67. (e) DISCOVER, 0.0.0.0 → 192.168.1.10, ports 68 to 67.
Follow-up
One of the five is perfectly legal but only because of the state the client happens to be in, so a blanket rule like "a client never sends from its own address" will mark it wrong. Two of the five fail on the same field.
Show the hint
For every packet ask two separate questions: which side sent it, and did that side already own an address at that moment. The two answers constrain different fields.

The request that arrives as something else

Medium
A campus has VLAN 20 as 10.20.0.0/16 with its gateway at 10.20.0.1, and one DHCP server at 10.99.0.5 in a different VLAN. A host in VLAN 20 boots. Give the source and destination IP of the DISCOVER as the host sends it; give the source and destination IP and the UDP ports of the packet the server actually receives; name the field that tells the server which pool to use and give its value; then describe how the ACK gets back to a host that still has no address.
Follow-up
Nothing in the packet that reaches the server says which subnet the host is on, because by then the source address belongs to something else entirely. One field carries that information, and the same field is also the return address.
Show the hint
A router never forwards a limited broadcast, so the relay is not forwarding anything. It is originating a brand-new packet of its own and copying the payload in, which means you should ask what source address a router uses when it originates a packet itself.

The printer, the new card, and the address somebody typed in

Medium
A printer has a server-side reservation for 192.168.1.50 bound to its MAC. Its network card fails and is replaced. Say what address the printer gets on its next boot and why, and what has to be changed. Separately, a second printer has 192.168.1.150 typed into its own front panel, and 192.168.1.150 sits inside the server pool. Describe the failure that eventually appears, name the message the client that hits it sends and who it sends it to, and say what that client does next.
Follow-up
Nothing here is misconfigured in the sense of a typo. Both halves are the same underlying mistake seen from two sides, and the second failure does not appear until an unrelated third device boots, possibly weeks later.
Show the hint
A reservation is looked up by one field of the request and by nothing else. For the second half, section 03 says a careful client checks the address before it uses it; ask what it does with the answer when the check comes back positive.

Two hundred and forty laptops, and the wrong reason to shorten a lease

Medium
A 50 minute class starts and 240 laptops join the Wi-Fi at t = 0. Assume one DHCP server, no losses, nobody leaving, and that all four messages of a fresh lease are broadcast while renewals are unicast. With a lease of 600 seconds, give the total number of DHCP messages sent during the class and how many of those are broadcasts. Then give both numbers again for a lease of 7200 seconds, and say what that comparison tells you about shortening a lease to reduce broadcast traffic.
Follow-up
Both totals matter and only one of them moves. Broadcast frames are the expensive ones on Wi-Fi, because they go to every station at the lowest supported rate, so the popular justification for a short lease turns out to be aimed at the wrong number.
Show the hint
Count one laptop first, and be careful about when the clock for the next renewal starts: a successful renewal does not extend the old lease, it replaces it with a fresh one beginning at that instant.

The rogue server, and the one machine it cannot touch

Hard
An attacker plugs a laptop running a DHCP server into a lab wall port. It hands out correct-looking addresses on the right subnet, but with itself as the default gateway and as the DNS server. Answer four things. (a) Explain why its offer can beat the real server’s, and say what actually decides the winner. (b) A machine that already holds a valid lease from the real server and is sitting at T1 is not affected at all. Explain precisely why, in terms of the addressing of the renewal. (c) Give the moment at which that same machine does become vulnerable, and what has to happen first. (d) The team turns on DHCP snooping. Say exactly which of the four DORA messages the switch drops on an untrusted port, and explain why dropping only those is enough while dropping all DHCP on those ports would break the network completely.
Follow-up
Nothing here exploits a bug: every message the attacker sends is a legal, well-formed DHCP message. Two of the four are messages the attacker has no business sending and two are not, and the entire defence turns on which is which. One machine on the segment is immune for a reason that has nothing to do with the switch at all.
Show the hint
Sort the four messages by who is entitled to send them at all, then re-read what the renewal at T1 is addressed to and ask whether the attacker is anywhere on that path.