DHCP

The DORA Process

DHCP operates through a four-step exchange known as DORA: Discover, Offer, Request, Acknowledge. A new device broadcasts a DHCPDISCOVER message (using BroadcastA network communication method that sends data to all devices on a subnet simultaneously. The broadcast address is the last address in a subnet, such as 192.168.1.255 for a /24 network. to 255.255.255.255) since it has no IP yet. One or more DHCP servers respond with DHCPOFFER messages containing a proposed Dynamic IPAn IP address that is temporarily assigned to a device by a DHCP server and may change over time. Most residential internet connections use dynamic IP addresses assigned by the ISP. address. The client selects an offer and broadcasts a DHCPREQUEST to formally request it. The chosen server confirms with a DHCPACK, and the client configures its interface.

Along with an IP address, DHCP delivers a complete network configuration: Subnet MaskA 32-bit number (e.g., 255.255.255.0) that divides an IP address into network and host portions. It determines which part of the address identifies the network and which part identifies individual devices., default gateway, DNS server addresses (see DNS ResolverA server that receives DNS queries from clients and resolves domain names by querying the DNS hierarchy on their behalf. Public resolvers like 1.1.1.1 (Cloudflare) and 8.8.8.8 (Google) are widely used alternatives to ISP resolvers.), lease duration, and optional parameters like NTP servers or domain search lists.

Leases and Renewal

Every DHCP address is temporary — it's a lease with an expiration time. At 50% of the lease lifetime, the client attempts to renew directly with its current server via unicast. At 87.5%, it broadcasts a renewal to any available server. If renewal fails and the lease expires, the client must release the address and restart DORA.

Short leases (minutes to hours) suit environments with frequent device turnover like Wi-Fi hotspots. Long leases (days) reduce broadcast traffic in stable networks.

DHCP Relay and Enterprise Deployments

Routers don't forward broadcasts, so subnets without a local DHCP server use a DHCP relay agent. The relay intercepts DHCPDISCOVER broadcasts, wraps them in unicast packets with the client's subnet information, and forwards them to a centralized DHCP server. Enterprises typically run redundant DHCP server pairs with split-scope or failover configurations to ensure availability.

DHCP snooping — a switch security feature — prevents rogue DHCP servers from handing out malicious gateway or DNS ResolverA server that receives DNS queries from clients and resolves domain names by querying the DNS hierarchy on their behalf. Public resolvers like 1.1.1.1 (Cloudflare) and 8.8.8.8 (Google) are widely used alternatives to ISP resolvers. addresses.