Walk me through how a client gets an IP address from DHCP.
Show the answer
Say this first
Four messages, known as DORA. The client broadcasts a DISCOVER from 0.0.0.0 port 68 to 255.255.255.255 port 67. Each server answers with an OFFER. The client broadcasts a REQUEST that names the server it picked (option 54), and that server confirms with an ACK carrying the lease and options. Server side is UDP 67, client side is UDP 68.
Go deeper
The four messages
| Message | Sent by | IP source to destination | What matters in it |
|---|---|---|---|
| DISCOVER | client | 0.0.0.0 to 255.255.255.255 | client MAC in chaddr, transaction ID xid |
| OFFER | server | server IP to the offered IP, or broadcast | yiaddr (the offered address), option 54 server ID, lease, mask, gateway, DNS |
| REQUEST | client | 0.0.0.0 to 255.255.255.255 | option 50 (the address it wants), option 54 (the server it chose) |
| ACK | server | server IP to the offered IP, or broadcast | the final lease (option 51) and all options |
The REQUEST is a broadcast on purpose. Every server that made an offer sees it, and the ones that were not chosen put their offered address back in the pool.
Unicast or broadcast replies
The client has no address yet, so how does the OFFER reach it? The client decides with the
broadcast flag, the top bit of the 16-bit flags field:
- Flag set: the server (or relay) broadcasts the OFFER and ACK.
- Flag clear: the server sends them as unicast IP to
yiaddr, addressed at layer 2 to the client MAC inchaddr.
Stacks that cannot accept unicast IP before the interface has an address set the flag.
Under the hood
DHCP messages are BOOTP packets with option 53 saying which message they are. That is why the ports
are named bootps (67) and bootpc (68). Option 53 values: 1 DISCOVER, 2 OFFER, 3 REQUEST,
4 DECLINE, 5 ACK, 6 NAK, 7 RELEASE, 8 INFORM.
After the ACK, many clients probe the address with ARP (RFC 5227) before using it. If another host answers, the client sends DECLINE and starts again.
They will ask next
Why does the client use fixed port 68 instead of an ephemeral port?
Replies may be broadcast. If they went to an ephemeral port, every host on the segment would receive a broadcast aimed at whatever application happened to own that port. A reserved client port means only DHCP clients listen for it.
What is DHCPINFORM for?
A host that already has a static address asks only for configuration (DNS servers, domain, proxy settings). The server answers with an ACK that carries options but no lease.
Can DHCP work with fewer than four messages?
Yes. Rapid Commit (option 80, RFC 4039) allows a two-message DISCOVER and ACK exchange in DHCPv4, but support is patchy. It is far more common in DHCPv6, where Solicit and Reply can complete the exchange.
Traps
- Saying the OFFER is always a broadcast or always a unicast. It depends on the broadcast flag and on whether a relay is in the path.
- Swapping the ports. Server listens on UDP 67, client on UDP 68.