NETWORK
DHCPDynamic Host Configuration Protocol
DHCP (Dynamic Host Configuration Protocol) is the service that automatically gives a device its IP address, subnet mask, default gateway and DNS servers when it joins a network. The device broadcasts a request, a DHCP server (usually the router) offers an address from its pool, and the device leases it for a set time.
The DORA exchange
A device with no address cannot send normal packets, so DHCP works by broadcast on the local segment:
| Step | Message | From → to | Content |
|---|---|---|---|
| 1 | Discover | Client (0.0.0.0) → broadcast | "I need configuration"; includes the client's MAC |
| 2 | Offer | Server → client | A proposed address, mask, gateway, DNS, lease time |
| 3 | Request | Client → broadcast | "I accept this offer from server X" |
| 4 | Acknowledge | Server → client | Confirmation; the lease starts |
The client then checks the address is not already in use (a gratuitous ARP) and configures itself. Port details are in the port 67/68 record.
What DHCP delivers
Beyond the address, servers send options: subnet mask (1), router/gateway (3), DNS servers (6), domain name (15), lease time (51), NTP servers (42), and vendor-specific options such as the TFTP server for VoIP phones (66/150) or the PXE boot file for network installation.
Leases and renewal
At half the lease time the client asks the same server to renew (unicast). If that fails, at 87.5% it broadcasts to any server. If the lease expires without renewal, the client must stop using the address and start over. Because renewals usually succeed, a device tends to keep the same address indefinitely while it stays on the network.
Reservations
A reservation binds a MAC address to a fixed IP in the server's configuration. It is the preferred way to give printers, NAS units and servers a stable address; see static vs dynamic IP.
Relay agents
Broadcasts do not cross routers, so a DHCP server can only serve its own segment unless a relay agent on each router forwards Discover messages to it as unicast, tagging them with the subnet they came from. That is how a single Windows Server DHCP role serves dozens of VLANs.
Security
DHCP is unauthenticated. A rogue server can hand out a malicious gateway or DNS server; DHCP snooping on switches, which only trusts server messages from designated ports, is the standard defence. DHCP starvation (a client requesting every address in the pool) is limited by port security or rate limiting.
Troubleshooting on Windows
ipconfig /allRead DHCP Enabled, DHCP Server, Lease Obtained and Lease Expires. Then:
ipconfig /release
ipconfig /renewIf renewal fails and the adapter gets 169.254.x.x, the server is unreachable: check the cable or Wi-Fi association, whether the router's DHCP service is on, and whether the pool is exhausted (common on guest networks with short-lived devices). The ipconfig record explains the options.
Frequently asked questions
What happens if two DHCP servers are on the same network?
Clients accept whichever offer arrives first, so devices end up with inconsistent settings, often a wrong gateway or DNS. This is the classic "someone plugged a home router into the office" fault. Find and remove the extra server; managed switches can block it with DHCP snooping.
How long is a DHCP lease?
Whatever the server is configured for. Home routers commonly use 24 hours; corporate networks use 8 hours to several days; guest Wi-Fi often uses one hour so addresses are recycled quickly.
What is 169.254.x.x?
An Automatic Private IP Addressing (APIPA) address. Windows assigns it when no DHCP server responds. Devices with such addresses can talk to each other on the same segment but have no gateway, so no internet.