Skip to content
Knowledge Hub/Article
Article

What Is DHCP and How Does It Assign IP Addresses?

We explain how DHCP gives devices an IP address and network settings, the DORA steps, leases, relay agents, DHCPv6 and the risk of rogue servers.

Oğuzhan Gerçek··10 min read
What Is DHCP and How Does It Assign IP Addresses?

Short answer: DHCP (Dynamic Host Configuration Protocol) is the protocol that automatically gives a device joining a network its IP address, subnet mask, default gateway and DNS servers. The device broadcasts to find a server, a server offers an address, the device requests it and the server acknowledges; the four steps are known by their initials as DORA. Addresses are handed out on a time-limited lease, and the device starts renewing it halfway through. When the server sits on another subnet, a Layer 3 device in between forwards the requests as a DHCP relay; in IPv6, DHCPv6 and SLAAC share the job.

What is DHCP?

DHCP is still defined by RFC 2131, published in March 1997. According to the RFC, DHCP provides a framework for passing configuration information to hosts on a TCP/IP network and is based on BOOTP (Bootstrap Protocol). In Microsoft's definition, it is a client/server protocol that automatically provides a host with its IP address and related settings such as the subnet mask and default gateway.

According to Microsoft, DHCP reduces the typing errors of manual configuration and the conflicts caused by assigning the same address to two computers. Messages travel over UDP: those from client to server go to port 67, those from server to client to port 68 (see our port article).

What is an IP address?

RFC 791 (September 1981), which defines IP, separates three ideas: a name indicates what we seek, an address indicates where it is, and a route indicates how to get there. DNS turns the name into an address and a router finds the route; the IP address itself is the device's location on the network. According to RFC 791, an IPv4 address is 32 bits long, which allows 2 to the power of 32 (about 4.3 billion) possible values. According to RFC 4291, an IPv6 address is a 128-bit identifier for an interface. The subnet mask marks which bits of the address identify the network and the subnet (RFC 950). We cover private address blocks in our LAN article and how they are translated on the way to the internet in our NAT article.

How does DHCP work? The DORA steps

According to RFC 2131, four messages go back and forth when a client gets an address; Microsoft's troubleshooting guide calls this flow DORA, after their initials:

  1. Discover: The client broadcasts a DHCPDISCOVER on its local subnet to find a server. Because it has no address yet, the packet's source address is 0 (0.0.0.0).
  2. Offer: Each server that responds offers an address and configuration in a DHCPOFFER.
  3. Request: The client picks one offer and broadcasts a DHCPREQUEST; the server identifier in the message shows its choice and implicitly declines the other offers.
  4. Acknowledge: The chosen server commits the address with a DHCPACK.

The RFC recommends that the client run a final check (for example with ARP) before using the address; if another device already has it, the client sends a DHCPDECLINE.

Lease time and renewal

Under dynamic allocation in RFC 2131, an address is assigned for a limited period, in other words on a lease. Two thresholds come into play before the lease runs out:

  • T1 (default: 50% of the lease): The client moves to the RENEWING state and sends a DHCPREQUEST directly (unicast) to the server that granted the lease.
  • T2 (default: 87.5%): If no DHCPACK has arrived by then, the client moves to the REBINDING state and broadcasts the DHCPREQUEST.

If the lease expires before a DHCPACK arrives, the client immediately stops any other network processing and starts over. In Microsoft's example scenario, the scope's default lease is 8 days; to optimize address utilization, mobile devices get 8 hours and servers and printers 60 days. With an 8-day lease, T1 falls on day 4 and T2 on day 7.

Scopes, reservations and DHCP options

According to Microsoft, a scope is the range of IP addresses the DHCP server hands out to clients. A reservation ties an address to a network card's MAC address and leases it only to that device. The settings that come with the address are defined as numbered options in RFC 2132 (March 1997):

  • 1: Subnet mask
  • 3: Routers on the client's subnet, in other words the default gateway
  • 6: DNS servers
  • 51: Lease time

With a static IP, the address is typed into the device by hand; under manual allocation in RFC 2131, too, the administrator chooses the address and DHCP simply conveys it. According to Microsoft, the DHCP server itself needs a static IPv4 address. According to RFC 2131, dynamic allocation is the only mechanism that automatically reuses an address that is no longer needed.

Different subnets and VLANs: DHCP relay

According to Cisco, routers do not forward broadcast packets by default, so a client cannot reach a DHCP server on a different subnet on its own. When users sit on separate VLANs and the server is on another subnet, a Layer 3 device in between acts as the relay agent and carries the requests to the server. The relay writes the address of the interface on which it received the request into the message's gateway IP address (giaddr) field; according to RFC 2131, the server selects the address based on that field. This lets a single server cover many subnets, each with its own scope. According to Cisco's Catalyst documentation, the relay is set up with the ip helper-address command on the Layer 3 interface closest to the client.

DHCPv6 and SLAAC in IPv6

IPv6 offers two ways to get an address. In stateless address autoconfiguration (SLAAC), defined in RFC 4862 (September 2007), routers advertise the subnet prefix and the device generates its own interface identifier and combines the two; no extra server is needed. Flags in the Router Advertisement tell the host which path to take: according to RFC 4861, the M flag indicates that addresses are available via DHCPv6, and the O flag that other information, such as DNS settings, is.

DHCPv6 is now defined by RFC 9915, published in January 2026 as an Internet Standard (STD 102), which replaced RFC 8415. In IPv6, the four-step exchange uses Solicit, Advertise, Request and Reply messages. Clients listen on UDP port 546, servers and relay agents on port 547. According to RFC 9915, DHCPv6 can operate in place of SLAAC or alongside it.

DHCP security: rogue servers, starvation and DHCP snooping

The security section of RFC 2131 is blunt: DHCP is built directly on UDP and IP, which are inherently insecure. An unauthorized DHCP server is easy to set up and can hand clients wrong addresses, spoofed routers or spoofed DNS servers. According to MITRE ATT&CK, an attacker can use this to pull traffic to their own system and gain an adversary-in-the-middle position. Exhausting the address pool with a flood of DISCOVER broadcasts, leaving legitimate clients without addresses, is also possible (DHCP starvation).

The mitigation MITRE recommends is DHCP snooping on Layer 2 switches, which prevents both rogue servers and starvation attacks. According to Cisco's documentation, DHCP snooping treats ports connected to the DHCP server as trusted and ports connected to clients as untrusted. By default, every port is untrusted, and a DHCPOFFER, DHCPACK or DHCPNAK arriving from the untrusted side is dropped.

According to Microsoft, unauthorized Windows DHCP servers installed in an Active Directory domain cannot lease addresses.

DHCP in the enterprise: failover, IPAM and DNS registration

According to Microsoft, a Windows computer that cannot reach a DHCP server assigns itself an address from the 169.254.0.0-169.254.255.255 range reserved by IANA. According to RFC 3927, such addresses are only valid for communication with devices on the same link. With DHCP failover, introduced in Windows Server 2012, two servers share IPv4 scopes, leases and reservations; if one goes down, the other keeps granting leases. It has two modes: load balance (default split 50-50) and hot standby.

According to Microsoft, IPAM (IP Address Management) is a suite of tools for planning, deploying, managing and monitoring IP address infrastructure. A DHCP server can also update DNS records when leases are assigned or renewed, so devices can be reached by name (see our DNS article). We cover a network's address plan in our network and traffic engineering service and the operation of DHCP and DNS servers in our infrastructure management service.

Frequently asked questions

What does DHCP stand for? Dynamic Host Configuration Protocol: the protocol that gives devices their IP address and network settings automatically.

What is a DHCP server? A server that leases IP addresses to devices on the network and also sends them settings such as the subnet mask, default gateway and DNS servers.

What is the difference between DHCP and a static IP? With DHCP, the address comes from a server on a time-limited lease; a static IP is typed into the device by hand. With a reservation, the address still comes from DHCP but is always the same.

Why does my IP address start with 169.254? Windows assigns itself an address from this range when it cannot reach a DHCP server. Such an address is only valid for communication with devices on the same link.

Which ports does DHCP use? In IPv4, the server uses UDP port 67 and the client port 68. In DHCPv6, clients listen on port 546, servers and relay agents on port 547.

Sources