DHCP

Dynamic Host Configuration Protocol

DHCP is a network management protocol used on IP networks for automatically assigning IP addresses and other network configuration parameters to devices, so they can communicate.

It is build on top of BOOTP , adds lease-based address allocation, and operates over UDP . Clients broadcast a DHCPDISCOVER message; a DHCP server responds with configuration including the subnet mask , default gateway , and DHCP server addresses.

The DORA Process

4-way handshake

Every new DHCP lease begins with four UDP messages exchanged between client and server.

DHCPDISCOVER

Client broadcasts on UDP port 67 from 0.0.0.0 → 255.255.255.255. No IP assigned yet — seeks any available DHCP server. 

Src: 0.0.0.0:68
Dst: 255.255.255.255:67
Transaction ID: 0x3903F326
Client MAC: AA:BB:CC:DD:EE:FF
DHCPOFFER

Server reserves an IP and sends an offer: proposed address, subnet mask, default gateway, DNS servers, and lease duration. 

Offered IP: 192.168.1.42
Subnet: 255.255.255.0
Gateway: 192.168.1.1
Lease: 86400 s
DHCPREQUEST

Client broadcasts its acceptance of the offer. Broadcasting lets other DHCP servers know their offers were declined. 

Requested IP: 192.168.1.42
Server ID: 192.168.1.1
Src: 0.0.0.0:68
Still no address yet
DHCPACK

Server confirms. Lease begins. Client configures its network stack with the received parameters and is now online. 

Assigned: 192.168.1.42
T1 (renew): 43200 s
T2 (rebind): 75600 s
DNS: 8.8.8.8, 8.8.4.4

Packet Structure

236 bytes fixed

The DHCP packet format inherits from BOOTP . The fixed header is 236 bytes followed by a magic cookie (99.130.83.99) and variable-lengthoptions (up to 312 bytes by default in RFC 2131 ).

Client fields Relay fields Address fields Identity fields
op 8b Message Type
1=BOOTREQUEST, 2=BOOTREPLY
htype 8b Hardware Type
1 = Ethernet
hlen 8b Hardware Len
6 for MAC addresses
hops 8b Hops
Relay agent hop count
xid 32b Transaction ID
Random number to match replies
secs 16b Seconds
Time since client started
flags 16b Flags
Broadcast flag (bit 0)
ciaddr 32b Client IP
Client IP if already has one
yiaddr 32b Your IP
IP address offered/assigned
siaddr 32b Server IP
Next server to use in bootstrap
giaddr 32b Gateway IP
Relay agent address
chaddr 128b Client MAC
16 bytes, padded with zeros

Lease Lifecycle

A DHCP lease has three time thresholds defined in the DHCPACK. At T1 the client tries to renew directly; at T2 it broadcasts a rebind request; at expiry it must start over with DORA.

24-hour lease · T1=12h · T2=21h

Bound

0 -=) T1 (50%)

Using IP. Client waits.

Renewing

T1 -=) T2 (87.5%)

Unicast DHCPREQUEST to original server.

Rebinding

T2 -=) Exp (100%)

Broadcast DCHPREQUEST - any server can reply.

Init / DORA

Expiry

Must restart full DORA handshake.

Security Considerations

4 known attack vectors

DHCP has no built-in authentication mechanism . All DHCP messages are UDP broadcasts that any device on the local network segment can send or intercept. Countermeasures are implemented at the switch and OS level.

Rogue DHCP Server

CWE-441 Critical

An attacker runs an unauthorized DHCP server that responds to DHCPDISCOVER messages before the legitimate server, routing traffic through the attacker.

MITIGATION

Enable DHCP Snooping on all access switches. Only "trusted" uplink ports are allowed to send DHCPOFFER and DHCPACK.

DHCP Spoofing

CWE-290 High

Variant of rogue DHCP where the attacker crafts forged DHCPACK replies to hijack an ongoing assignment, providing a malicious gateway or DNS server.

MITIGATION

DHCP Snooping + Dynamic ARP Inspection (DAI) to validate ARP packets against the snooping binding table.

DHCP Starvation

CWE-400 Medium

Attacker floods the server with DHCPDISCOVERs using spoofed MAC addresses, exhausting the IP address pool. Legitimate clients receive no address.

MITIGATION

Rate-limit DHCP requests per port on managed switches. Combine with port security (MAC address limiting).

IP Conflict Attack

CWE-693 Medium

Attacker pre-configures a static IP that a DHCP server is about to assign. Causes an IP conflict, disrupting the legitimate client's connectivity.

MITIGATION

Configure DHCP server to perform ping-before-assign (ICMP echo check) befire issuing an address.

Relayted Topics

8 articles
PROTOCOL
DHCPv6

Extension of DHCP for IPv6, defined in RFC 8415. Supports both stateful and stateless operation.

NETWORKING
DNS (Domain Name)

Often provisioned via DHCP Option 6. Translates hostnames to IP addresses.

NETWORKING
Subnetting

The practice of dividing a network into sub-networks. DHCP scopes map directly to subnets.

HISTORY
BOOTP

DHCP predecessor, RFC 951. Stateless — no lease concept, no address recycling.

SECURITY
DHCP Snooping

Layer 2 security feature that validates DHCP messages on a switch to prevent rogue servers.

PROTOCOL
SLAAC

Stateless Address Autoconfiguration for IPv6 — an alternative to DHCPv6 for address assignment.

HARDWARE
Relay Agent

A router or switch that forwards DHCP packets between clients and servers on different subnets.

OS
APIPA

Automatic Private IP Addressing — Windows fallback when no DHCP response is received. 169.254.0.0/16.