DHCP Fundamentals
DHCP does not just hand out any IP address. The service manages time-limited leases and gives clients a consistent network configuration.
Before you start
Who is this for?
For learners who want to understand automatic IPv4 configuration and typical DHCP problems.
Prerequisites
- IPv4 address, prefix, and gateway
- Broadcast domains and VLANs
What you'll be able to do
- Explain DORA and lease renewal
- plan a DHCP scope without conflicts
- distinguish relay, options, and reservations
- systematically narrow client and server errors
Practical outcome
You can design a DHCP range with exclusions, gateway, and DNS options for a VLAN and verify it.
1. What problem does DHCP solve?
Section titled “1. What problem does DHCP solve?”Without DHCP, every network interface would have to be manually given an IP address, prefix length, a default gateway, and DNS servers. That is error-prone and does not scale. The Dynamic Host Configuration Protocol assigns these values from a managed pool. An assignment is called a lease because it is only valid for a certain time.
A DHCP server manages one scope or pool per IP network. It contains the dynamic address range and options. Statically configured routers, servers, printers, and management devices must lie outside the pool or be explicitly excluded.
2. Discover, Offer, Request, Acknowledge
Section titled “2. Discover, Offer, Request, Acknowledge”A new DHCPv4 client knows neither its address nor the server. The simplified first assignment is described as DORA:
- DHCP Discover: The client sends a search, initially usually as a broadcast.
- DHCP Offer: A server offers an address, lease time, and options.
- DHCP Request: The client requests a selected offer and informs the other servers of its choice.
- DHCP Acknowledge: The server confirms the lease. Only then does the client use the configuration normally.
DHCPv4 uses UDP: server port 67 and client port 68. Because UDP does not establish a connection like TCP, the mapping must happen through transaction data and the DHCP protocol state.
A client normally renews the lease well before it expires. Simplified, it first tries to reach the current server directly. Later it searches more broadly for a renewal. If everything fails until the lease expires, the client may not keep using the address indefinitely.
3. Scope, options, and reservations
Section titled “3. Scope, options, and reservations”For VLAN 10 with 192.168.10.0/24, a plan could look like this:
| Element | Value | Rationale |
|---|---|---|
| Network | 192.168.10.0/24 |
Scope belongs exactly to this subnet |
| Gateway | 192.168.10.1 |
static, not assigned dynamically |
| Infrastructure | .2–.49 |
switches, APs, or fixed reservations |
| Pool | .50–.199 |
dynamic clients |
| DNS servers | 192.168.10.10, 192.168.10.11 |
DHCP option, no reachability guarantee |
| Lease | e.g. 8 hours | choose to match the rate of change |
A reservation links a known client identifier, or MAC address, to a fixed lease in the DHCP system. A static address is set directly on the endpoint. Reservations keep the central overview better organized, but they do not change the fact that MAC addresses are manipulable.
4. DHCP across routers
Section titled “4. DHCP across routers”Routers do not forward local Layer 2 broadcasts to other networks by default. A central DHCP server could therefore not hear clients in other VLANs without help. A DHCP relay accepts the local request and sends it as a unicast to the server. In doing so, it provides information about the client network so that the server selects the correct scope.
The relay path must be correct for each client VLAN. A working scope for VLAN 10 does not prove that VLAN 20 is forwarded correctly. Firewalls must explicitly allow the required communication between relay and server.
5. What does 169.254.x.x mean?
Section titled “5. What does 169.254.x.x mean?”Many systems choose an address from 169.254.0.0/16 when no regular IPv4 configuration is available. This link-local address enables limited local communication, but normally provides no gateway path into the corporate network.
The correct conclusion is not automatically “DHCP server broken”. Possible causes are:
- the Wi-Fi or cable is not connected correctly;
- the access port is in the wrong VLAN;
- the DHCP relay is missing or points to the wrong server address;
- the scope is disabled or fully occupied;
- the server, routing, or firewall is not reachable;
- a protection feature drops untrusted DHCP responses.
6. Secure troubleshooting
Section titled “6. Secure troubleshooting”On Windows, Get-NetIPConfiguration and ipconfig /all show, among other things, the lease and DHCP server. ipconfig /release and ipconfig /renew actively change the configuration and should only be used in a suitable test environment. On Linux, the tool depends on the Network Manager; ip address, ip route, and journalctl first provide a safe inventory.
Check in this order: link → VLAN → existing client address → relay → scope utilization → server logs → firewall. A packet capture can distinguish a Discover from a missing Offer, but it contains device identifiers and must be protected.
Common mistakes
Section titled “Common mistakes”- Not excluding the gateway or server address from the dynamic pool.
- Creating a scope with the wrong mask for the client VLAN.
- Confusing a DHCP relay with a DHCP server.
- Investigating DNS immediately when seeing a link-local address.
- Connecting an unknown DHCP server: rogue DHCP can distribute wrong gateways or resolvers.
Plan a DHCP scope
Objective: Create a conflict-free scope for 60 clients and explain every exclusion.
Scenario: VLAN 20 uses 192.168.20.0/25. The gateway is .1, two DNS servers use .10 and .11, and ten infrastructure addresses must remain free.
- Document the network, broadcast, and usable host range.
- Define a dynamic pool for at least 60 clients.
- Exclude gateway, DNS, and infrastructure addresses.
- Record the gateway and DNS options.
- State where a relay is required if the server is in VLAN 99.
Possible solution
Usable hosts are.1–.126. One valid pool is .50–.119 (70 addresses), leaving .2–.49 and .120–.126 for controlled use. The VLAN 20 Layer-3 interface needs a relay target when the server is remote.Knowledge check
Section titled “Knowledge check”Multiple Choice
DHCP knowledge check
What you should now be able to do
Section titled “What you should now be able to do”- explain DORA and the purpose of a lease;
- distinguish pool, exclusion, reservation, and option;
- justify when a DHCP relay is required;
- narrow a missing address assignment from the client to the server.