DHCP

DHCP#

DHCP (Dynamic Host Configuration Protocol, RFC 2131) hands out IP addresses, gateways, DNS servers, hostnames, and dozens of other options to clients on a LAN. Without DHCP a network needs static config on every host; with DHCP a laptop joins the wifi and gets a working internet connection in two seconds. Operators meet DHCP at both ends: as a client (every laptop, container, cloud VM at boot), and as a server (DHCP daemons on routers, gateways, cloud VPCs, PXE-boot environments).

Two ports, both UDP:

Port	Use
67/UDP	Server, listens here, replies from here.
68/UDP	Client, sends from here, listens for replies.

DHCPv6 is a different protocol (RFC 8415) on UDP 546 (client) / 547 (server). IPv6 also has SLAAC (stateless), which is more common.

The DORA exchange#

A new client gets a lease in four messages, Discover, Offer, Request, Ack:

        sequenceDiagram
    participant C as Client
    participant S as DHCP server
    C->>S: DHCPDISCOVER, broadcast, src 0.0.0.0
    S->>C: DHCPOFFER, your IP + lease + options
    C->>S: DHCPREQUEST, broadcast, I will take this one
    S->>C: DHCPACK, confirmed, lease starts
    Note over C,S: Client renews at T1 (~50% of lease)
    C->>S: DHCPREQUEST, unicast, still here
    S->>C: DHCPACK

Message	Meaning
DHCPDISCOVER	“Anybody home? I need an address.” Client broadcast.
DHCPOFFER	Server proposes an address + options.
DHCPREQUEST	Client accepts one offer (in case multiple servers replied).
DHCPACK	Server confirms; lease now binding.
DHCPNAK	Server rejects (e.g. you tried to renew an expired or wrong-subnet lease); client restarts at DISCOVER.
DHCPDECLINE	Client refuses (e.g. ARP says address is in use).
DHCPRELEASE	Client gives the lease back early.
DHCPINFORM	Client has a static address but wants config options.

Common options#

A DHCP packet’s payload is a list of options, identified by code:

Code	Meaning
1	Subnet mask
3	Default gateway (router)
6	DNS servers
12	Hostname
15	Domain name
42	NTP servers
51	Lease time (seconds)
60	Vendor class identifier (clients announce themselves)
66	TFTP server name (PXE boot)
67	Boot filename (PXE boot)
119	DNS search list
121	Classless static routes
252	WPAD URL (proxy auto-config)

Linux clients#

Three implementations dominate:

Client	Where you find it
`dhclient` (ISC)	Most distros’ default; legacy but solid. `/var/lib/dhcp/dhclient.*.leases` is the on-disk lease store.
`systemd-networkd`	Built-in; configured per-interface in `/etc/systemd/network/*.network` with `DHCP=yes`.
`NetworkManager`	Desktops / laptops; uses dhclient or its internal client. `nmcli` is the CLI.
`dhcpcd`	Default on Alpine, some embedded.

# legacy dhclient
$ sudo dhclient -r eth0                      # release
$ sudo dhclient    eth0                      # renew
$ sudo dhclient -v eth0                      # foreground + verbose

# systemd-resolved + networkd
$ networkctl status eth0
$ resolvectl                                 # what DNS / domains came from DHCP

# NetworkManager
$ nmcli -p connection show <connection>      # all params, including DHCP
$ nmcli connection up <connection>           # full re-acquire

# current default route + DNS (regardless of stack)
$ ip route show default
$ resolvectl dns

Servers#

Server	Notes
`isc-dhcp-server`	Classic ISC `dhcpd`. Configured in `/etc/dhcp/dhcpd.conf`. EOL upstream (2022) but still widely deployed.
`Kea`	ISC’s replacement for ISC DHCP. JSON config, supports DHCPv4 + v6, REST API.
`dnsmasq`	Lightweight DHCP + DNS + TFTP in one daemon. Default on home routers, common on small networks and PXE setups.
`systemd-networkd`	Acts as a DHCP server for downstream interfaces (`DHCPServer=yes`).
`Cloud / VPC services`	AWS, GCP, Azure handle DHCP for VMs; options come from the VPC config.

Quick ad-hoc server with dnsmasq:

$ sudo dnsmasq --no-daemon --interface=eth1 \
               --dhcp-range=10.0.0.50,10.0.0.100,12h \
               --dhcp-option=3,10.0.0.1 \
               --dhcp-option=6,1.1.1.1,8.8.8.8 \
               --log-dhcp

ISC dhcpd.conf skeleton:

default-lease-time 600;
max-lease-time 7200;
authoritative;

subnet 10.0.0.0 netmask 255.255.255.0 {
    range 10.0.0.50 10.0.0.100;
    option routers 10.0.0.1;
    option domain-name-servers 1.1.1.1, 8.8.8.8;
    option domain-name "lab.local";
    option ntp-servers pool.ntp.org;
}

host printer {
    hardware ethernet aa:bb:cc:dd:ee:ff;
    fixed-address 10.0.0.10;
}

Operator pitfalls#

Rogue DHCP servers, a misconfigured laptop or attacker sending OFFERs faster than the legitimate server hands out wrong gateways and DNS. Detect with nmap --script broadcast-dhcp-discover or by sniffing port 67. Switch-side mitigation is DHCP snooping.
PXE boot, options 66 (TFTP server) + 67 (boot file) + vendor class are how diskless servers and OS deployment work; if PXE is broken, take a DHCP capture first.
Lease exhaustion, a small range plus device churn (CI workers, IoT) hands out DHCPNAKs; check dhcpd.leases size / age, widen the pool.
Static + DHCP conflict, DHCP offers an address that’s already statically configured elsewhere; the second client gets ARP conflicts and DECLINEs the lease. Watch for DHCPDECLINE in server logs.
DHCP fingerprinting, option 55 (parameter request list), 60 (vendor class), and 12 (hostname) leak OS / device identity; used by NAC / fingerprinting tools.