What happens as a DHCP lease runs out? Explain T1, T2 and DHCPNAK.
Show the answer
Say this first
At T1, half the lease by default, the client unicasts a REQUEST to the server that gave it the lease. If that fails, at T2 (87.5 percent of the lease) it broadcasts a REQUEST to any server: that is rebinding. If the lease expires with no answer, the client must stop using the address and start again with DISCOVER. A server sends DHCPNAK when the client asks for an address that is wrong for its subnet, for example a laptop that moved to another VLAN.
Go deeper
Client states
| State | When | What it sends |
|---|---|---|
| BOUND | after the ACK | nothing |
| RENEWING | at T1 (option 58) | unicast REQUEST to the option 54 server, ciaddr filled in |
| REBINDING | at T2 (option 59) | broadcast REQUEST to any server |
| INIT | lease expired or NAK | DISCOVER, from scratch |
| INIT-REBOOT | after a reboot with a remembered address | broadcast REQUEST with option 50 |
NAK and silence
After a reboot the client asks for its old address. A server that knows the subnet is wrong answers
with a NAK, and the client restarts at DISCOVER. A server with no record of the client should stay
silent. ISC dhcpd only sends NAKs for a network when it is marked authoritative.
Release
ipconfig /release or dhclient -r sends DHCPRELEASE, which returns the address early.
Choosing lease times
- Guest Wi-Fi and busy shared spaces: short leases (1 to 8 hours) so the pool recycles.
- Wired desktops: long leases. The Windows Server default is 8 days, the IOS default is 1 day.
- A long lease also lets existing clients ride out a DHCP server outage longer.
They will ask next
With a 24 hour lease, when does the client first try to renew?
At 12 hours (T1). Rebinding starts at 21 hours (T2 is 87.5 percent), and the address is lost at 24 hours if nobody answers.
The DHCP server died an hour ago. Who notices first?
New devices and devices coming back from sleep with an expired lease. Existing clients keep working until their lease runs out, so a dead DHCP server is often discovered hours later.
Why must the client subnet be able to reach the server directly?
The renewal at T1 is a unicast to the server address, not a broadcast through the relay. If an ACL or firewall blocks UDP 67 from the client subnet, clients fall back to rebinding at T2 and the problem stays hidden until something else changes.
Traps
- Saying the renewal is a broadcast. Only rebinding at T2 is.