DHCP is the service that automatically assigns a device its TCP/IP configuration when it joins a network: an address, a subnet mask, a default gateway and DNS servers, in four packets.
The address is a lease with an expiry rather than a permanent grant, which is why a DHCP fault often looks like a total network failure instead of a missing address.
- Four packets, remembered as DORA
- UDP 67 on the server, UDP 68 on the client
- An address is a lease, and it expires
- Broadcasts do not route, so a relay agent forwards them
- A second DHCP server on the wire is the classic outage
On this page
The exchangeThe four packet exchange
DHCP clients joining a network know nothing: not their own address, not the gateway, not who to ask. So a client shouts, and the DHCP exchange that follows has four steps.
Discover. The client broadcasts a DHCP Discover to the whole network segment, from address 0.0.0.0 because it does not have one yet, asking whether any DHCP server is listening. It includes its MAC address, which is the only identity it has.
Offer. Any DHCP server that hears it replies with an Offer: here is an available address you may have, along with a mask, a gateway, DNS servers and a lease time, which is the dynamic part of the protocol name. The server sets that address aside while it waits.
Request. The client broadcasts a Request naming the offer it accepts. This is broadcast rather than sent directly for a reason: if several servers made offers, this tells the others their offer was declined so they can release the address they were holding.
Acknowledge. The chosen server confirms with an Acknowledge, writes the lease data into its database, and the client configures itself with the network configuration it just received.
The whole thing takes milliseconds and the acronym DORA is how everyone remembers the order. Two details are worth carrying.
The first two messages are broadcasts because the client has no address and no idea where the server is. That is why DHCP does not cross a router by itself, and why the relay agent in a later section exists.
The client can also skip straight to a Request when it already had a lease and is trying to renew or reclaim the same address after a reboot. Two packets rather than four, and it is why a machine usually gets its old address back.
Four more DHCP messages round out the communication, and they explain most of what you will see in a packet capture.
Nak is the server refusing a Request, usually because the client asked for an address that is not available on this network any more, and it forces the client to start over.
Decline is the client refusing an offered address because it found another host already answering on it. Release is a client giving an address back, which is what a clean shutdown does. Inform is a client that already has a static address asking only for the additional settings, the DNS servers among them.
LeasesWhat a lease actually is
The address is borrowed, and the borrowing has a clock. This is the part that produces the most confusing symptoms.
A lease has a duration, commonly eight days on an office network and much shorter on a guest network where clients pass through. Three timers matter.
At half the lease, the client tries to renew, directly to the server that granted it. Usually the server says yes, the clock resets, and nobody notices.
At seven eighths, if renewal has not worked, the client broadcasts to any server that will listen, because its own server may be gone.
At expiry, the client must stop using the address. In practice it starts the whole exchange again, and if nothing answers it ends up with no address at all.
Lease length is a real design decision. Long leases are stable and waste addresses on devices that visited once. Short leases recycle addresses quickly and multiply the renewal traffic.
The rule of thumb: match the lease to how long devices actually stay. A day for an office, an hour or two for a guest network, weeks for a network of fixed equipment.
The symptom worth recognizing: a machine that works for days and then loses the network at the same interval is a lease that cannot renew, not a failing network card.
DHCP optionsThe options, which are the real content
An address alone is useless. What makes DHCP work is the rest of the network configuration it delivers, and each item is a numbered DHCP option in the protocol.
| Option | What it sets | What breaks without it |
|---|---|---|
| Subnet mask | Which addresses are local | Everything, the device cannot tell local from remote |
| Router | The default gateway | Nothing outside the local subnet is reachable |
| DNS servers | Name resolution | Names do not resolve, so it looks like no internet |
| Domain name | The suffix appended to short names | Short names fail, full names work |
| NTP servers | Time | Authentication fails in confusing ways |
| Lease time | How long the address is held | Defaults apply, usually badly |
| Option 43 and 66 | Vendor specific, and boot server | Phones and access points never find their controller |
The last row is where the interesting outages live. Voice over IP phones and wireless access points commonly find their controller through a DHCP option, so a network rebuild that recreates the scope without those options produces phones that boot and never register, with no error that mentions DHCP.
RelayCrossing subnets, and the relay agent
Discover is a broadcast, and routers do not forward broadcasts. So a DHCP server on one subnet cannot hear a client on another, which would mean one server per subnet.
The relay agent solves that. It is a small service on the router or layer 3 switch, configured with the address of the DHCP server. It listens for DHCP broadcasts on its interface, wraps them into a normal unicast packet and forwards them to the server, then relays the answer back.
Two things follow.
The relay tells the server which subnet the request came from. It writes its own interface address into the packet, and the server uses that to choose which scope to answer from. That is how one server serves fifty subnets correctly.
A missing relay looks like a dead DHCP server. Devices on the affected subnet get nothing, devices everywhere else are fine, and the server logs show no requests at all. On Cisco equipment the command is ip helper-address, which is why people call it a helper.
PitfallsWhere it goes wrong
A rogue DHCP server on the network. The classic outage, and the reason DHCP is a security concern and not only an addressing one. Somebody plugs a home router into a wall socket, its built in DHCP server starts answering, and whichever server replies first wins each race.
Devices get addresses from the wrong range, with a gateway that goes nowhere. The symptom is that some machines work and some do not, changing on every reboot. Managed switches block this with DHCP snooping, the security feature that drops server replies arriving on ports that should only hold clients.
An attacker who answers DHCP requests first owns the gateway and the DNS servers of every client that believed the answer, which is why snooping is worth turning on.
The DHCP pool runs out. More clients than available addresses on the network, and new arrivals cannot connect at all. A guest network with a long lease and heavy footfall reaches this quickly, because every phone that passed through is still holding an address it will never use again.
Reservations confused with static addresses. A reservation is the DHCP service assigning the same address to the same MAC every time, and it stays managed centrally. A static address is typed into the device and known only to it. Reservations are almost always the better choice, because the device can be renumbered without visiting it.
The static range overlaps the pool. Somebody assigns a printer 192.168.1.50 by hand, DHCP later hands the same address to a laptop, and both suffer. Reserve a block outside the pool for manual assignment and write down where it starts.
The DNS servers point at the wrong place. A domain joined machine that receives a public DNS server from DHCP instead of the domain controller cannot find anything internal. Everything looks fine, the internet works, and nothing on the network resolves.
The server is a single point of failure. Everything keeps working while leases are valid, so an outage is invisible for hours and then affects everyone at once. Two DHCP servers with split scopes, or a failover pair, is the standard answer on networks that cannot afford the morning it would cost.
DiagnosisReading a DHCP problem
The diagnostic order that works, on any platform.
Check whether an address was received at all. An address starting 169.254 is the giveaway: that is the range a machine picks for itself when no DHCP server answered. It means the request went unanswered, so look at the network path before the server.
Release and renew. On Windows ipconfig /release then ipconfig /renew, on Linux the equivalent for your client. Watching what happens is more informative than the result.
Read the lease data on the server. If the client appears there with an address it is not using, the answer never reached it. If it does not appear, the DHCP requests never arrived.
Check the relay on the client's subnet. A subnet with no helper configured produces exactly this and nothing in the server logs.
Look for a second server. If different devices get addresses from different ranges, there are two. On a managed switch, DHCP snooping will name the port.
ComparisonDynamic DHCP, a reservation and a static address, on the criteria that decide it
| Criterion | Dynamic DHCP | DHCP reservation | Static on the device |
|---|---|---|---|
| Address is predictable | No | Yes | Yes |
| Changed without touching the device | Yes | Yes | No |
| Survives the DHCP server being down | No | No | Yes |
| Recorded somewhere you can read | Yes | Yes | No |
| Effort per device | None | Low | High |
| Right for a laptop | Yes | No | No |
| Right for a printer or a camera | No | Yes | No |
| Right for the DHCP server itself | No | No | Yes |
The middle column is the one people skip. A reservation gives a device the same address every time while the record stays on the server, so renumbering a network means editing scopes rather than walking to every device.
Static addressing earns its place in exactly one situation: equipment that has to work when DHCP does not, the DHCP server and the domain controllers among them.
FAQFrequently asked questions
What is DHCP in simple terms?
The protocol that hands a device its network configuration automatically when it joins a network, instead of somebody typing it in.
What does DORA stand for?
Discover, Offer, Request, Acknowledge. The four packets of the exchange, in order.
What ports does DHCP use?
UDP 67 on the server and UDP 68 on the client. It is part of the TCP/IP suite but does not use TCP itself, because a client with no address cannot open a connection.
What is a DHCP lease?
A time limited grant of an address. The client renews at half the lease, and must stop using the address if the lease expires.
Why did my device get a 169.254 address?
No DHCP server answered, so the machine assigned itself a link local address. That is a network path or server problem, not a client one.
What is a DHCP reservation?
The server always assigning the same address to the same MAC. Better than a static address on the device, because it stays centrally managed.
Why does DHCP not work across a router?
Because the first messages are broadcasts and routers do not forward them. A relay agent, configured with the server's address, forwards them.
What happens if two DHCP servers answer?
Whichever replies first wins each request, so clients get addresses from different ranges and some of them do not work. DHCP snooping, a security feature on managed switches, stops it.
How long should a lease be?
As long as devices actually stay. A day for an office, an hour or two for guest wifi, longer for fixed equipment.
Can I use DHCP for servers?
Yes, with reservations, and many places run infrastructure services that way. What matters is that the address is predictable, not that it was typed on the machine.
What is option 66 for?
A boot server address, used by network devices that read their configuration information at startup, phones and access points among them. A scope rebuilt without it produces devices that boot and never register.
Is there a DHCP for IPv6?
Yes, DHCPv6, and IPv6 also has stateless autoconfiguration where a device builds its own address automatically from a router advertisement. Many networks run both.
What is the DORA process?
The DORA process is the four message exchange that gives a client its address: Discover, Offer, Request and Acknowledge. The client broadcasts a Discover, a server replies with an Offer, the client sends a Request for that offer, and the server confirms with an Acknowledge.
What does DHCP stand for?
DHCP stands for Dynamic Host Configuration Protocol. It is the service that hands a device its IP address, subnet mask, default gateway and DNS servers when it joins a network, so nobody has to type them in.
What is the DHCP process, step by step?
The DHCP process has four messages. The client broadcasts a Discover. A server answers with an Offer of an address. The client sends a Request for that offer. The server confirms with an Acknowledge and the lease starts. The client renews the lease at half its lifetime.
What is the difference between PPPoE vs DHCP on a router's WAN port?
They are two ways a router gets its internet settings. With DHCP the provider's network hands the router an address automatically. With PPPoE the router must log in with a username and password before it receives one, which is common on DSL and some fiber lines. Your provider decides which one applies.
Keep readingRelated concepts
Read next · Addressing What Is a Subnet? The mask DHCP hands over is what tells a device which addresses are local, and that is a subnet. Open this next15 min- Directory and identity · 15 min Active Directory Explained A domain joined machine that receives the wrong DNS servers from DHCP cannot find the directory at all.
- Protocols · 10 min TCP vs UDP DHCP runs over UDP, and the reason is in this page: a client with no address cannot open a connection.
- DNS · 10 min The SOA Record, Field by Field How a client finds a resolver at all.
- Diagnostics · 13 min ipconfig and ip, and What the Output Is Telling You The service that did not answer.
- Wireless · 9 min A WLAN Is a LAN With a Radio in Front of It Where a failed lease shows up first.
- Addressing · 11 min What Is CIDR? How the block a device gets its address from is sized and allocated in the first place.
- Diagnostics · 11 min Ping and Traceroute What to run once the address is correct and something still does not answer.
- Fundamentals · 10 min Modem and Router, and What the Box From Your Internet Provider Does How devices get their settings without anybody typing them.
- DNS · 14 min DNS Not Resolving What hands a machine its DNS servers in the first place, and what happens when it does not.
- Addressing · 10 min Default Gateway What the gateway address DHCP handed you is actually for.
- Fundamentals · 13 min ARP Explained, and the One Thing Everyone Gets Wrong About It Where the address being resolved usually came from.
- Fundamentals · 9 min Link Local Addresses, and Why One of Them Is Bad News What failed, when the IPv4 link local address appeared.