Skip to content

DHCP Fundamentals

DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses and other network settings (subnet mask, default gateway, DNS servers) to clients, so devices don't need to be manually configured with a static IP.

The DORA Process

A client obtaining an address from a DHCP server goes through four steps, all over UDP ports 67 (server) and 68 (client) — see TCP vs UDP & Common Ports:

  1. Discover — client broadcasts "is there a DHCP server out there?" (it has no IP yet, so this must be a broadcast)
  2. Offer — a DHCP server responds with a proposed IP and lease terms
  3. Request — client broadcasts back requesting that specific offer (broadcast, so any other DHCP servers that also offered know their offer wasn't taken)
  4. Acknowledge — server confirms, and the client can now use the address
Client                          Server
  |-- DHCPDISCOVER (broadcast) -->|
  |<---- DHCPOFFER ---------------|
  |-- DHCPREQUEST (broadcast) --->|
  |<---- DHCPACK -----------------|

Lease Time & Renewal

Addresses are leased, not permanently assigned. A client tracks two timers relative to its lease length:

  • T1 (~50% of lease) — client attempts to renew directly with the server that issued the lease
  • T2 (~87.5% of lease) — if renewal with the original server failed, client broadcasts to renew with any DHCP server

If the lease fully expires with no renewal, the client must start over from Discover.

DHCP Across Subnets: Relay (ip helper-address)

DHCP's Discover/Request messages are broadcasts, and broadcasts don't cross a router by default — so a DHCP server on one subnet can't naturally hear clients on another. A DHCP relay agent (usually the router/L3 switch acting as the client's default gateway) listens for these broadcasts and forwards them as unicast to a specified DHCP server:

interface Vlan20
 ip address 10.0.20.1 255.255.255.0
 ip helper-address 10.0.99.5

Without this, every VLAN needing DHCP would need its own local DHCP server — ip helper-address lets one central server handle every VLAN's leases.

Basic Cisco IOS DHCP Server Config

Cisco switches/routers can act as the DHCP server themselves for small deployments:

ip dhcp excluded-address 10.0.10.1 10.0.10.10   ! Reserve addresses (gateway, static devices) out of the pool

ip dhcp pool OFFICE
 network 10.0.10.0 255.255.255.0
 default-router 10.0.10.1
 dns-server 8.8.8.8
 lease 7

lease 7 sets a 7-day lease; omit it and the default is 24 hours on most platforms.

Security Note

Because DHCP has no built-in authentication, a rogue DHCP server on the network can hand out bogus gateway/DNS settings and silently redirect client traffic. This is exactly what DHCP Snooping prevents — only explicitly trusted ports are allowed to source DHCP server traffic (Offers/Acks); everything else is treated as a client-only port.