dhcp ipv4

The Dynamic Host Configuration Protocol (DHCP) is an automatic configuration protocol used on IP networks [RFC 2131]. A major advantage is that it eliminates the need to manually assign each host a static IP address. Hosts can ‘ask’ to join a network and they will be assigned an IP, and provided with additional information such as the subnetmask and gateway IP.

There are two versions of DHCP, one for IPv4 and one for IPv6. While both versions bear the same name and perform much the same purpose, the details of the protocol for IPv4 and IPv6 are sufficiently different that they can be considered separate protocols. In this article we explain the DHCP for IPv4 protocol and its packets.

The DHCP ‘boot’ procol has four steps.

The four most important DHCP packets are: DHCPDISCOVER, DHCPOFFER, DHCPREQUEST and DHCPACK. All DHCP traffic is encapsulated in UDP, and flows between port 68 (client) and port 67 (server). With Wireshark, you can look at DHCP traffic by using “bootp” in the display filter.

We have the following scenario:

  • A client with MAC-address 00:11:11:11:11:11 and no IP address. This client wants to join the network.
  • A DHCP server with IP and MAC-address 00:22:22:22:22:22.

A typical exchange of DHCP messages for such a scenario looks like this:

Packet Source Destination
sent by client
IP =
IP =
The DHCP discover packet is a request that is broadcast by clients that want to join a network. The packet contains the client MAC address. Additionally, it contains a list of information the client would like to receive. This list may include: subnet mask, DNS server IP, domain name, NETBIOS server IP, etc.
sent by DHCP server
IP =
IP =
When a DHCP server receives an IP lease request from a client, it reserves an IP address for the client and extends an IP lease offer by sending a DHCPOFFER message to the client. The client may receive one or more DHCPOFFER messages from one or more DHCP servers. This message contains the client’s MAC address, the IP address that the server is offering, the subnet mask, the lease duration, and the IP address of the DHCP server making the offer.
sent by client
IP =
IP =
A client may choose to accept one of the offered IP address by broadcasting a DHCP request packet. This message contains the IP the client wants to start using, and the IP of the DHCP server that offered the IP. The message is broadcast to the entire network; when other DHCP servers receive this message, they withdraw any offers that they might have made to the client and return the offered address to the pool of available addresses.
sent by DHCP server
IP =
IP =
When the DHCP server receives the DHCPREQUEST message from the client, the configuration process enters its final phase. The acknowledgement phase involves sending a DHCPACK packet to the client. This packet includes the lease duration and any other configuration information that the client might have requested. At this point, the IP configuration process is completed.

The protocol expects the DHCP client to configure its network interface with the negotiated parameters.

After this configuration protocol is completed the client can start using IP address If the DHCPACK message contained information about the default gateway, then the client can also start browsing the Internet without further configuration.

Other DHCP packets are:

  • DHCPRELEASE: The client may choose to relinquish its lease on a network address by sending a DHCPRELEASE message to the server. It is not required by the DHCP protocol to send this message, and not every OS does it by default.
  • DHCPINFORM: Clients may request local configuration parameters outside of the ‘boot process’ using DHCPINFORM packets. Servers receiving a
    DHCPINFORM message construct a DHCPACK message with any local configuration parameters appropriate for the client, without allocating a new address for the client

On windows, the ipconfig tool can be used to view the current IP lease, and force renewal of the lease.

C:\>ipconfig /all

Ethernet adapter Local Area Connection:

 Connection-specific DNS Suffix  . : some.domain.com
 Description . . . . . . . . . . . : Realtek RTL8168B/8111B Family PCI-E Gigabit Ethernet NIC (NDIS 6.20)
 Physical Address. . . . . . . . . : 00-1A-2D-39-65-3D
 DHCP Enabled. . . . . . . . . . . : Yes
 Autoconfiguration Enabled . . . . : Yes
 IPv4 Address. . . . . . . . . . . :
 Subnet Mask . . . . . . . . . . . :
 Lease Obtained. . . . . . . . . . : Tuesday, June 21, 2011 8:07:58 PM
 Lease Expires . . . . . . . . . . : Tuesday, June 21, 2011 10:07:58 PM
 Default Gateway . . . . . . . . . :
 DHCP Server . . . . . . . . . . . :
 DNS Servers . . . . . . . . . . . :
 Primary WINS Server . . . . . . . :
 Secondary WINS Server . . . . . . :
 NetBIOS over Tcpip. . . . . . . . : Enabled

Release the IPv4 address:

C:\>ipconfig /release

Request a new IPv4 address:

C:\>ipconfig /renew

On most Linux distros the ifconfig tool can be used to view the current IP lease.

$ ifconfig
eth0      Link encap:Ethernet  HWaddr 00:1A:2D:39:65:3D
          inet addr:  Bcast:  Mask:
          RX packets:8675279 errors:0 dropped:0 overruns:0 frame:0
          TX packets:189402 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:1193997808 (1.1 GB)  TX bytes:16051772 (16.0 MB)
          Interrupt:10 Base address:0xd000

The DHCP client on Linux is called dhclient or dhclient3. To see if you are currently running the client:

$ ps -ef | grep dhclient
root      3169     1  0 09:10 ?        00:00:00 dhclient3 -e IF_METRIC=100 -pf /var/run/dhclient.eth0.pid -lf /var/lib/dhcp3/dhclient.eth0.leases eth0

Use the -r switch to release your DHCP lease and terminate the client.

$ sudo dhclient -r

And restart it to negotiate a new lease. The dhclient program will stay in the foreground until it has obtained an IP, then fork into the background.

$ sudo dhclient eth0
The DHCP Protocol for IPv4 Explained

Leave a Reply

Your email address will not be published. Required fields are marked *