DHCP

DHCP (Dynamic Host Configuration Protocol) is the protocol that lets a device get an IP address and the rest of its network settings on its own as soon as it joins a network: the subnet mask, the default gateway, and the DNS server addresses. It works as a client-server exchange: the device (the client) asks, and a DHCP server answers. Without it, someone would have to type these settings in by hand on every computer, phone, and printer. DHCP runs over UDP — the server listens on port 67 and the client on port 68. The rules are defined in RFC 2131 (with RFC 2132 covering the extra options); the IPv6 version, DHCPv6, is defined in RFC 8415.

How does DHCP work? The DORA process

A device gets its address in four steps. Their first letters spell DORA (Discover, Offer, Request, Acknowledge). Three of these messages are broadcasts, because at the start the client has no address yet and doesn’t know who specifically to talk to:

1. Discover — the address-less client broadcasts a DHCPDISCOVER question to the whole network (from 0.0.0.0 to 255.255.255.255) to find available servers.
2. Offer — every server that heard the question reserves a free address and replies with a DHCPOFFER proposing that address and the settings.
3. Request — the client picks one offer and broadcasts a DHCPREQUEST with the chosen server’s number. The other servers then know their offers were turned down.
4. Acknowledge — the chosen server confirms the assignment with a DHCPACK (or refuses it with a DHCPNAK). From that point the client may use the address for the length of the lease.

Beyond these four, the client and server exchange other messages too: DHCPDECLINE (the client noticed the address is already in use), DHCPRELEASE (the client gives the address back early), and DHCPINFORM (a device with a fixed address asks only for the remaining settings).

What is a DHCP lease and how is it renewed?

An address from DHCP isn’t granted forever, only for a set time — this is the lease. It’s a bit like borrowing something: when the time is up, you either give it back or extend it. Two timers keep track of this:

• T1 (renewal, by default at 50% of the lease) — the client tries to extend the lease by sending a DHCPREQUEST directly (unicast) to the server that gave it the address.
• T2 (rebinding, by default at 87.5% of the lease) — if that server stays silent, the client asks any DHCP server on the network to extend the lease.

If the lease expires and no one renews it, the client has to give the address back and start the whole DORA process again. Leasing lets the server reclaim addresses from devices that have left the network — which matters, because there is only a finite number of IPv4 addresses.

What settings does DHCP deliver? DHCP options

Besides the IP address itself, the server hands over extra settings as DHCP options. Each option uses a TLV format: type, length, and value. The most common ones are:

• Option 1 — subnet mask,
• Option 3 — default gateway (router),
• Option 6 — DNS server addresses,
• Option 51 — lease time,
• Option 53 — DHCP message type (DISCOVER, OFFER, REQUEST, ACK, and others),
• Option 82 — Relay Agent Information; added by an intermediary device to show which port or segment the request came from and to apply the right assignment rules.

What is a DHCP relay agent?

A DHCPDISCOVER message is a broadcast, and by default it doesn’t leave its own subnet — routers don’t pass broadcasts along. So when a network has several subnets, a DHCP relay agent is used. It usually runs on a router or a Layer 3 switch (on Cisco gear the ip helper-address command sets it up). The relay catches the client’s broadcast and forwards it as a regular message (unicast) to a shared DHCP server in another subnet. That way one server can handle many segments, and there’s no need to run a separate server in every subnet.

What are the address allocation methods?

• Dynamic allocation — the server lends an address from a pool (scope) for the length of the lease; when the lease expires the address returns to the pool.
• Automatic allocation — the server assigns an address from the pool permanently, with no time limit.
• Manual allocation (reservation) — the administrator ties a specific IP address to a device’s MAC address, so the device always gets the same address.

What are the security risks of DHCP?

In its basic form, DHCP doesn’t check identities — not the client’s, not the server’s. Anyone on the network can pretend to be either side, which opens the door to several access-layer attacks:

• Rogue DHCP server — an unauthorized server answers faster than the real one and feeds clients forged settings (for example, its own address as the gateway and DNS server). Traffic starts flowing through the attacker — a classic man-in-the-middle attack (someone quietly sitting in the middle). It can also happen by accident, from a home router that got plugged in.
• DHCP starvation — the attacker floods the server with DHCPREQUEST messages using fake MAC addresses until the address pool runs dry. New users then can’t get an address (a denial-of-service, or DoS, attack), and this is often just the setup for planting a rogue DHCP server.
• DHCP spoofing — impersonating the server and sending clients incorrect settings.

How do you protect DHCP? DHCP snooping

The main defense is DHCP snooping — a switch feature that sorts ports into two groups:

• trusted — facing the real DHCP servers; only these ports are allowed to carry server replies (OFFER, ACK, NAK),
• untrusted — user ports; if a server reply arrives on one of them, the switch drops it. This blocks rogue DHCP.

Along the way, DHCP snooping builds a binding database that remembers which MAC address got which IP address, for how long, on which VLAN, and on which port. This database is the foundation for further protections, such as Dynamic ARP Inspection (DAI) and IP Source Guard. Snooping can also limit how many DHCP packets a port may send (rate limiting), which makes starvation attacks harder.

Why does DHCP matter for network monitoring and security?

DHCP data is a valuable source of information for SOC, NDR, and network monitoring teams. The allocation logs (DISCOVER/OFFER/REQUEST/ACK) and the binding database let you tie an IP address to a MAC address and a specific device at a given moment. That can be key during an investigation after an incident — it helps establish who held a given address when something happened. Things worth watching for include: DHCPOFFER/DHCPACK replies from an unauthorized source (rogue DHCP), a sudden burst of DHCPDISCOVER messages from many different MAC addresses (possible starvation), changes to the gateway or DNS server being handed to clients, and devices that bypass DHCP and use static addresses outside the policy.

Learn more

• ARP spoofing – how to detect a Man-in-the-Middle attack and ARP poisoning in a LAN network — DHCP assigns IP addresses that ARP spoofing can abuse to intercept local traffic.
• NAC — NAC can restrict which devices receive DHCP leases on the network.
• Secure Access Service Edge (SASE) — SASE may secure access to DHCP-managed networks and remote endpoints.
• Reflection Attack — Reflection attacks often abuse UDP services, including DHCP, to amplify traffic.
• Asset Discovery — DHCP lease data helps discover and track assets on the network.
• North-South vs East-West Traffic — DHCP is local infrastructure traffic, usually part of east-west communication.