DHCP (Dynamic Host Configuration Protocol)

DHCP automatically assigns IP addresses and network config to devices, so you don't have to manually configure each one.

What DHCP Provides

• IP address
• Subnet mask
• Default gateway
• DNS server address
• Lease time

DORA Process — The 4-Step IP Assignment

D — Discover

• Client joins network, has no IP yet.
• Sends a broadcast: 0.0.0.0 → 255.255.255.255.
• Message: "Is there a DHCP server out there?"
• Uses UDP port 67 (server) and 68 (client).

O — Offer

• DHCP server receives Discover.
• Server offers an available IP from its pool.
• Still a broadcast (client has no IP yet).
• Includes: offered IP, subnet mask, gateway, DNS, lease time.

R — Request

• Client receives offer (may get multiple if multiple servers).
• Client selects one and broadcasts a request.
• Broadcast so other servers know their offer was rejected.
• Message: "I want to use the IP offered by Server X".

A — Acknowledge

• Server confirms the lease.
• Sends DHCPACK with final configuration.
• Client can now use the IP.

DORA Summary

Client                              Server
  |                                    |
  |------ DISCOVER (broadcast) ------->|
  |                                    |
  |<------ OFFER (broadcast) ----------|
  |                                    |
  |------ REQUEST (broadcast) -------->|
  |                                    |
  |<------ ACK (broadcast) ------------|
  |                                    |
  | Now has IP and config              |

Why All 4 Steps Are Broadcast?

Step	Why Broadcast?
Discover	Client has no IP, doesn't know server
Offer	Client has no IP yet to receive unicast
Request	Must notify ALL servers (not just one)
ACK	Client technically doesn't have IP confirmed yet

Key DHCP Concepts

Lease Time

• IP is assigned for a limited time.
• Client must renew before expiry (at 50% of lease time, client tries to renew).
• If renewal fails → client tries again at 87.5%.
• If lease expires → client restarts DORA.

DHCP Relay Agent

• DHCP uses broadcasts — broadcasts don't cross routers.
• If DHCP server is on a different network, a relay agent (on the router) forwards DHCP messages as unicast to the server.

DHCP Pool / Scope

• Range of IPs the server can assign.
• Example: 192.168.1.100 – 192.168.1.200.

DHCP Reservation

• Bind a specific IP to a MAC address.
• Device always gets the same IP (useful for printers, servers).

DHCP Ports

	Port
DHCP Server	UDP 67
DHCP Client	UDP 68

DHCP Vulnerabilities

Attack	Description
DHCP Starvation	Attacker floods server with fake requests, exhausting IP pool
Rogue DHCP Server	Attacker sets up fake DHCP server, sends malicious config (wrong gateway → MitM)

Defense → DHCP Snooping on switches (only allows trusted ports to respond to DHCP)