DHCP: Where Addresses Come From
A laptop joins a LAN with no address and configures itself. Then a server answers, four packets change everything, and the lease must be defended.
An interactive Networking lesson: 23 steps, about 30 minutes, on a live simulation in your browser.
Evening in a small office. pc1, pc2 and pc3 sit on one switch with static addresses, and a printer nobody configured blinks in the corner. Now a laptop is plugged in and booted. It has never been on this network, and nobody typed an address into it.
Its first act is to ask for one over DHCP, the Dynamic Host Configuration Protocol, the service that hands out addresses on nearly every LAN. It hears nothing back. So it does what every modern machine does with silence: it gives itself 169.254.5.23 and gets on with local life.
What you will learn
The laptop joins
- A laptop joins the LAN: A new machine asks the LAN for an address before it uses one. Silence is an answer too: it means configure yourself.
- Who else can it reach?: The same wire does not mean reachable. A host sends only where its routes allow; everything else dies inside its own kernel.
- The fallback has a name: 169.254.0.0/16 is the address of last resort: self-assigned, valid on this wire only, and a sure sign DHCP never answered.
The address it gave itself
- Heard but not answered: Instant refusal is your own kernel: no route. A timeout is the network's silence: the packet left and no answer came back.
- The /16 it lives in: Link-local is picked, probed, then used: random inside 169.254/16, checked with ARP, never routed.
- Can the printer call out?: A route on one host changes nothing on any other. Every machine decides with its own table.
Nobody answered
- Three shouts into the dark: DORA: the client Discovers, a server Offers, the client Requests, the server Acknowledges. No Offer, no lease — and the client waits only so long.
- Break it: cut the server cable
- No name server either: Without a resolver address, names do not resolve. That address is configuration too, and it arrives in the same lease.
Four packets, one address
- Start the server: DHCP is a conversation between neighbours: client port 68, server port 67, UDP, link-local scope.
- Who does the Discover reach?: Discover is a broadcast because the client knows no server. Shout first; addresses come later.
- Offer, then Request: Offer is unicast to the asker; Request is broadcast so losers withdraw. The client takes the first good offer.
- Ack: the lease is real: The Ack turns an offer into a lease: an address plus a deadline, with T1 and T2 marking when to renew.
What the lease carries
- Read the applied lease: A lease is four facts in one packet: my address, my way out, my name server, and when to come back.
- Drill: read the stored lease
- Half the lease passes: T1 is a quiet unicast to your own server. Renew early, renew privately; broadcast only when that fails.
- Drill: renew the lease now
The server that lies
- Two offers arrive: DHCP trusts the wire: first valid Offer wins, no ID checked. Speed beats legitimacy.
- Break it: the wrong gateway: A timeout beyond the wire with a gateway you never set means someone else is routing you. Read ip route before anything else.
- Snooping: trust the port: Snooping trusts ports, not packets: Offers may only enter through the uplink. Everything else is dropped at the wire.
IPv6 does it differently
- IPv6 does it differently: v6 announces what v4 leases: routers advertise the prefix and flags, hosts address themselves, DHCPv6 fills the gaps.
Recap & playground
- Cheat sheet
- Playground