Every time you connect a phone to Wi-Fi or plug a laptop into a cable, the device obtains, within moments, an IP address, subnet mask, gateway and DNS servers. Nobody types them in: DHCP (Dynamic Host Configuration Protocol) does it. It is such an unobtrusive service that you only notice it exists when it stops working, and at that point nothing connects any more.
The four steps: DORA
A freshly connected device has no address and does not know where the DHCP server is. The conversation therefore uses broadcast messages, sent to the whole local network, over UDP (port 67 for the server and 68 for the client):
- Discover: the client asks "is there a DHCP server?".
- Offer: the server replies, proposing a free address and the network parameters.
- Request: the client declares that it accepts the offer (if it received several, it picks one and tells everyone).
- Acknowledge: the server confirms, and from then on the client may use the address.
The initials give the acronym DORA, worth remembering when you analyse a traffic capture.
The lease: a loan with a deadline
The address is not assigned forever but on a lease for a set time, for example 24 hours. The client renews it automatically:
- halfway through the lease it tries to renew with the server that assigned it;
- if it gets no reply, at around seven-eighths of the lease it asks any available server;
- if the lease expires without renewal, the client must stop using the address and start over.
The ideal duration depends on the network:
| Network | Suggested duration | Reason |
|---|---|---|
| Guests, public places | 1-4 hours | Many passing devices, addresses must be freed quickly |
| Home, office | 12-24 hours | Stable devices, little renewal traffic |
| Servers and fixed devices | Reservation | Always the same address |
If the range is small and devices are many, overly long leases can exhaust the available addresses: newcomers cannot connect.
Reservations: fixed addresses without manual setup
A reservation (or static lease) binds a device's MAC address to a specific IP. The device keeps using DHCP but always receives the same address. It is the best solution for printers, NAS units, cameras and servers, because:
- configuration stays centralised in one place;
- if you change the gateway or DNS, every device receives the new values on renewal;
- you avoid conflicts between a manually set IP and one assigned by DHCP.
One note: many modern phones and computers use randomised MAC addresses for each Wi-Fi network, for privacy reasons. To reserve an address for these devices you need to disable the feature for that specific network, or use the random MAC, which usually stays constant for the same network.
DHCP options
Besides the address, the server sends a number of options. The most common:
- subnet mask and default gateway;
- DNS servers and local search domain;
- time servers (NTP);
- network boot information (PXE), used to install operating systems on many computers;
- additional static routes.
If you run a local DNS with filtering, these options are how you hand it out to every device.
DHCP across several networks: the relay
Broadcast messages do not cross routers. On a network split into VLANs, therefore, you either have a DHCP server on each segment or configure a DHCP relay on the router: it picks up the VLAN's requests and forwards them to a central server, indicating which network they come from so the server assigns an address from the right range. Most routers with VLAN support instead build in a DHCP server for each interface directly.
Rogue DHCP servers
If a network has two DHCP servers, clients accept whichever offer arrives first. It happens more often than you might think: a second router accidentally connected via a LAN port, an access point with DHCP left on, a test device. The result is clients receiving the wrong gateway and losing connectivity seemingly at random.
It can also be an attack: a malicious DHCP server can hand out a gateway or DNS controlled by an attacker. On managed switches, the DHCP snooping feature lets you declare which ports may host a DHCP server and discard offers from all others.
Fixing common problems
- A 169.254.x.x address: the client got no reply from DHCP. Check the link, the VLAN and the server's status.
- An address from an unexpected network: there is probably a second DHCP server.
- Some devices no longer connect: check whether the range is exhausted.
- To force a renewal:
ipconfig /releaseandipconfig /renewon Windows, or disconnect and reconnect the interface on other systems.
In short
- DHCP assigns address, gateway, DNS and other options through Discover, Offer, Request, Acknowledge.
- Addresses are leased and must be renewed: match the duration to the type of network.
- Use reservations for devices that need a fixed IP.
- Across VLANs you need a server per interface or a DHCP relay.
- A second DHCP server causes intermittent faults: DHCP snooping prevents them.
