DHCP (Dynamic Host Configuration Protocol) is a network protocol that automatically provides IP addresses and other network parameters to devices connected to a network. Simply put, when a computer, phone, or another device connects to a network via Wi-Fi or cable, it needs certain settings to communicate with the internet and other network devices. These mainly include an IP address, subnet mask, default gateway, and DNS server information. If DHCP is not used, these parameters may need to be entered manually for each device. In large networks with hundreds or thousands of devices, this approach is both time-consuming and increases the risk of configuration errors. DHCP automates this process. For example, when a laptop connects to an office Wi-Fi network, the DHCP server can automatically provide it with an appropriate IP address and other network settings. RFC 2131 defines automatic, dynamic, and manual address allocation mechanisms in DHCP. With dynamic allocation, an IP address is assigned to a device for a specific period known as the lease time.

What Is DHCP Used For?

The main purpose of DHCP is to automatically manage IP addresses and other TCP/IP parameters within a network. DHCP can be used in environments ranging from small home networks to large corporate infrastructures. For example, if a company has 300 employee computers, instead of manually assigning an IP address to each computer, a DHCP server can automatically select an available address from a defined IP range and assign it to the device.

In addition to an IP address, DHCP can also provide devices with parameters such as:

• Subnet Mask;
• Default Gateway;
• DNS Server;
• Lease Time.

Cisco’s DHCP documentation also explains that this information can be provided to the client during the Offer stage.

How Does DHCP Work?

When a new device connects to a network, it usually does not know in advance which IP address it should use. For this reason, it exchanges specific messages to locate a DHCP server and obtain the required network parameters.

The process is commonly explained in four stages:

Discover → Offer → Request → Acknowledge

This sequence is commonly abbreviated as DORA. Cisco also describes the DHCP handshake using these four stages.

What Is the DORA Process?

DORA represents the first letters of the four main stages involved in obtaining an IP address through DHCP.

1. DHCP Discover

The client connects to the network and does not know where the DHCP server is located. Therefore, it sends a DHCP Discover message across the network.

In simple terms:

Client: “Is there a DHCP server on the network that can give me an IP address?” This message is usually broadcast within the local broadcast domain.

2. DHCP Offer

The DHCP server receives the Discover message and offers an available IP address to the client.

For example:

IP Address: 192.168.1.25

Subnet Mask: 255.255.255.0

Default Gateway: 192.168.1.1

DNS Server: 8.8.8.8

Lease Time: 8 hours

This response is called a DHCP Offer.

3. DHCP Request

The client sends a DHCP Request message to indicate that it wants to accept the offered IP address. If several DHCP servers exist on the network, the client may receive multiple Offers. The client identifies the selected offer through the Request message.

4. DHCP Acknowledge

Finally, the DHCP server sends a DHCP ACK — Acknowledge message. After this stage, the client begins using the assigned IP address and other network parameters.

This completes the DORA process.

What Is a DHCP Server?

A DHCP Server is a system that manages IP addresses and other network parameters within a network.

A DHCP Server may exist in different forms, including:

• a DHCP service built into a router;
• Windows Server;
• Linux Server;
• dedicated network hardware.

On Linux systems, a DHCP server service may operate as a daemon such as dhcpd. The DHCP server manages an IP range defined by the administrator and assigns available addresses from that range to clients.

For example:

Network: 192.168.10.0/24

DHCP Pool:

192.168.10.50

to

192.168.10.200

In this case, the DHCP server can assign suitable IP addresses from this range to clients.

What Is a DHCP Client?

A DHCP Client is a device that wants to obtain its network configuration from a DHCP server.

For example:

• laptop;
• desktop computer;
• smartphone;
• printer;
• IP phone;
• camera;
• server;
• IoT device

can operate as DHCP clients. The main function of a client is to communicate with the DHCP server when it connects to the network and obtain the appropriate network parameters.

What Are DHCP Scope and Pool?

A DHCP Scope or Pool is the range of IP addresses that a DHCP server can distribute to clients.

For example:

192.168.1.100

to

192.168.1.200

There are 101 IP addresses in this range, and the DHCP server can assign them to suitable clients.

A scope may include not only an IP address range, but also other parameters such as:

• Subnet Mask;
• Default Gateway;
• DNS Server;
• Lease Time.

In large networks, separate DHCP scopes can be created for different VLANs and subnets.

What Is a DHCP Lease?

An IP address assigned to a client by DHCP is usually not permanent. The period during which the device is allowed to use the assigned IP address is called a DHCP Lease. For example, the lease time may be 8 hours. This does not mean that the device will immediately lose its IP address after 8 hours. The client usually attempts to renew the lease before it expires. RFC 2131 defines a lease as the period for which a network address is assigned to a client and allows the client to extend the lease later. The lease mechanism helps use IP addresses more efficiently. For example, after a user disconnects from a guest Wi-Fi network and leaves the office, the IP address they were using can later be reassigned to another device.

What Is DHCP Reservation?

Sometimes a specific device needs to receive the same IP address every time while still using DHCP. In this case, DHCP Reservation can be used.

For example:

Printer MAC Address:

00:11:22:33:44:55

Reserved IP:

192.168.1.20

Each time the printer contacts the DHCP server, the server can assign the address 192.168.1.20 to that device. This approach can make it easier to manage printers, cameras, and other fixed devices.

What Is the Difference Between DHCP and Static IP?

When DHCP is used, the IP address is automatically provided by a server. When a Static IP is used, the network parameters are usually configured manually on the device. For example, DHCP may be more practical for user laptops. Servers, some printers, and network devices may require a fixed address. For this purpose, either a Static IP or DHCP Reservation can be used. The main advantage of DHCP is centralized and automatic management. The main advantage of a Static IP is that the device’s address does not change.

What Is a DHCP Relay Agent?

A DHCP Discover message is usually a broadcast message, and routers do not automatically forward broadcasts to another subnet. This can create a problem when the DHCP server is located on a different network. To solve this issue, a DHCP Relay Agent is used.

For example:

VLAN 10

192.168.10.0/24

|

|

Router

|

|

DHCP Server

192.168.100.10

A client in VLAN 10 sends a DHCP Discover message. The router or Layer 3 device acts as a DHCP Relay and forwards the request to the DHCP server located on another network. As a result, there is no need to install a separate physical DHCP server for every VLAN. In JET Academy’s IT Specialist course, DHCP Server and Relay Agent configuration are also taught as dedicated topics.

What Is the Relationship Between DHCP and VLAN?

In large corporate networks, users are often divided into different VLANs.

For example:

VLAN 10 — Finance

192.168.10.0/24

VLAN 20 — HR

192.168.20.0/24

VLAN 30 — IT

192.168.30.0/24

A separate IP subnet and DHCP scope can be created for each VLAN. As a result, a device in VLAN 10 may receive an IP address from the 192.168.10.x range, while a device in VLAN 20 may receive one from the 192.168.20.x range. If the DHCP server is located in another VLAN, DHCP Relay can be used. For this reason, VLAN, Subnetting, and DHCP are closely related topics when studying Network Administration.

Which Ports Does DHCP Use?

DHCP uses the UDP protocol in IPv4.

By default:

• UDP Port 67 is used by the DHCP server;
• UDP Port 68 is used by the client.

If these ports are incorrectly blocked by a firewall or other security rules, DHCP communication problems may occur. In such cases, checking the firewall configuration and network traffic becomes part of the troubleshooting process.

What Happens When DHCP Does Not Work?

If a client cannot obtain an IP address from the DHCP server, network connectivity problems may occur. On Windows systems, the device may sometimes automatically assign itself an IP address from the 169.254.x.x range.

This mechanism is called APIPA — Automatic Private IP Addressing. According to Microsoft, when a DHCP server is unavailable, Windows can automatically select an address from the 169.254.0.0/16 range. Limited communication within the local network may still be possible with this address, but normal routed network and internet access are usually unavailable because no default gateway is assigned. For this reason, seeing a 169.254.x.x address on a Windows computer is often an important sign when investigating DHCP problems.

How Is DHCP Troubleshooting Performed?

If a client cannot obtain an IP address, the issue should be investigated systematically. First, the device’s physical or Wi-Fi connection should be checked. Then, it should be confirmed that the client is configured to use DHCP. On Windows, the following command provides information about the current IP configuration:

ipconfig /all

To renew the IP address, the following commands can be used:

ipconfig /release

ipconfig /renew

In addition, the following should be checked:

• Is the DHCP server running?
• Are there available IP addresses left in the DHCP pool?
• Is routing between the client and server configured correctly?
• Is DHCP Relay configured correctly?
• Is the VLAN configuration correct?
• Is the firewall blocking DHCP traffic?

Identifying network problems step by step in this way is part of the Troubleshooting process.

What Is a Rogue DHCP Server?

A Rogue DHCP Server is a DHCP server that has not been authorized by the network administrator. Such a server may provide incorrect network parameters to clients. For example, an attacker may attempt to configure their own device as the default gateway so that client traffic passes through it. For this reason, preventing unauthorized DHCP servers is important in corporate networks.

What Is a DHCP Starvation Attack?

In a DHCP Starvation attack, an attacker sends a large number of fake DHCP requests in an attempt to exhaust all available IP addresses in the DHCP server’s pool. As a result, legitimate users may be unable to obtain IP addresses from the DHCP server. In JET Academy’s Cybersecurity course, the DHCP process as well as DHCP Starvation attacks are also covered as separate topics.

What Is DHCP Snooping?

DHCP Snooping is a security feature used at the switch level to inspect DHCP traffic and prevent unauthorized DHCP servers. With DHCP Snooping, switch ports can be classified as trusted or untrusted. A trusted port connected toward the legitimate DHCP server can be configured as trusted, while user-facing ports can remain untrusted. Cisco describes DHCP Snooping as a Layer 2 security feature used to prevent malicious and unauthorized DHCP server messages. This feature can serve as one of the protection mechanisms against Rogue DHCP servers and certain DHCP Starvation scenarios.

What Should You Learn Before Studying DHCP?

To understand DHCP effectively, it is useful to first learn the following concepts:

• IP addressing;
• IPv4;
• Subnet Mask;
• Default Gateway;
• LAN;
• VLAN;
• Switch;
• Router;
• Subnetting.

After that, you can move on to topics such as:

• DHCP Scope;
• Lease;
• Reservation;
• DORA;
• Relay Agent;
• DHCP Snooping.

This knowledge is particularly important for professionals working in:

• Network Administration;
• System Administration;
• IT Support;
• Cybersecurity.

If you want to learn DHCP, VLAN, Subnetting, Switching, Routing, NAT, VPN, and other networking technologies through hands-on practice with real network equipment, you can explore JET Academy’s IT Specialist course.