What Is DHCP? Dynamic Host Configuration Protocol Explained

DHCP automatically assigns IP addresses and network settings to devices on a network. Learn how the DORA handshake works, what DHCP leases are, and how DHCP can be attacked.

What Is DHCP?

DHCP (Dynamic Host Configuration protocol) is a network protocol that automatically assigns IP addresses and other network configuration parameters to devices when they connect to a network. Without DHCP, administrators would have to manually configure the IP address-and-addressing-explained)-ipv6-and-addressing-explained), [subnet-explained) mask](/learning-center/what-is-subnetting-ip-subnets-and-cidr-explained), default gateway, and DNS servers for every device — an impractical task at scale.

DHCP operates at the application layer and uses UDP-the-internets-core-protocol) ports 67 (server) and 68 (client). It was standardised in RFC 2131 (1997) as an enhancement of the older BOOTP protocol.

What DHCP Assigns

When a device connects, DHCP can provide:

| Parameter | Example | Purpose | |---|---|---| | [IP address](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained) | 192.168.1.45 | Device's address on the network | | [subnet-subnets-and-CIDR-explained) mask](/learning-center/what-is-subnetting-ip-subnets-and-cidr-explained) | 255.255.255.0 | Network vs host portion | | Default gateway | 192.168.1.1 | router-network-address-translation-explained) to send traffic through | | DNS servers | 8.8.8.8, 1.1.1.1 | domain-kerberos-directory-services-explained) name resolution | | Lease duration | 86400 seconds | How long the IP is valid | | NTP server | pool.ntp.org | Time synchronisation | | domain-kerberos-directory-services-explained) name | company.local | Local domain for hostname resolution |

The DORA Handshake

DHCP uses a four-step process, remembered as DORA:

Client                    Network (broadcast)       DHCP Server
  |                              |                       |
  |-- DISCOVER (broadcast) ----->|---------------------->|
  |                              |                       |
  |<--------------------- OFFER ----------------------- |
  |                              |                       |
  |-- REQUEST (broadcast) ------>|---------------------->|
  |                              |                       |
  |<--------------------- ACK ------------------------- |
  |                              |                       |

1. Discover

The client (which has no IP yet) sends a broadcast-address-resolution-protocol-explained) UDP packet-ip-the-internets-core-protocol) to 255.255.255.255, port 67: > "I need an [IP address](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained). My MAC address-address-resolution-protocol-explained) is 00:1A:2B:3C:4D:5E."

2. Offer

The DHCP server responds (usually with a broadcast-address-resolution-protocol-explained) or unicast) with an [IP address](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained) lease offer: > "I offer you 192.168.1.45, [subnet-subnets-and-CIDR-explained) mask](/learning-center/what-is-subnetting-ip-subnets-and-cidr-explained) /24, gateway 192.168.1.1, for 24 hours."

3. Request

The client formally requests the offered IP (broadcast-address-resolution-protocol-explained) so other DHCP servers on the network know the offer was accepted): > "I accept the offer from server 192.168.1.1 for IP 192.168.1.45."

4. Acknowledge

The server confirms the lease and provides any additional options: > "Lease confirmed. Use 192.168.1.45 for the next 86400 seconds."

DHCP Leases

A DHCP lease is the time period for which the [IP address](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained) is assigned. After the lease expires, the device must renew it (usually at 50% of the lease period, the client attempts renewal). If renewal fails, at 87.5% the client tries any DHCP server. If the lease expires without renewal, the device loses its IP address.

Short leases (minutes to hours): Used for guest Wi-Fi where devices come and go frequently. Ensures IPS are reclaimed quickly.

Long leases (days to weeks): Used for stable environments. Reduces DHCP traffic overhead.

DHCP vs Static Assignment

| | DHCP | Static | |---|---|---| | Configuration | Automatic | Manual | | Consistent IP | No (may change on renewal) | Yes | | Use case | Workstations, phones, IoT | Servers, printers, routers | | Management overhead | Low | High at scale |

In practice, most production servers and network devices have static IPS (or DHCP reservations — a DHCP server configured to always give the same IP to a specific MAC address-address-resolution-protocol-explained)).

DHCP Relay Agents

In large networks, there is often one DHCP server for the entire organisation, but devices are on many different subnets. DHCP Discover packets are broadcast-address-resolution-protocol-explained) and cannot cross routers.

A DHCP relay agent (usually the router-network-address-translation-explained)) listens for DHCP broadcasts on each subnet-subnets-and-CIDR-explained) and forwards them as unicast to the central DHCP server, which is on a different subnet. The relay adds information about which subnet the request came from so the server can assign an appropriate IP from the right pool.

DHCP Security Attacks

DHCP has no built-in authentication, making it vulnerable to two attacks:

DHCP Starvation

An attacker sends thousands of DHCP Discover packets with spoofed MAC addresses, exhausting the DHCP server's address pool. Legitimate devices then cannot obtain IP addresses and are denied network access.

Defence: port-the-internets-core-protocol)-and-UDP-ports-explained) security on switches — limit the number of MAC addresses per port, or limit DHCP requests per port per second.

Rogue DHCP Server

An attacker connects a device that responds to DHCP Discover packets faster than the legitimate server. Clients accept the first offer they receive — so the attacker can hand out:

A wrong default gateway (attacker's machine) → [man-in-the-middle attack](/learning-center/what-is-a-man-in-the-middle-attack)
Wrong DNS servers → DNS hijacking for phishing

Defence: DHCP Snooping — a switch-virtual-local-area-network-explained) feature that designates trusted and untrusted ports. DHCP Offer and Acknowledge messages from untrusted ports are dropped, preventing rogue servers.

DHCPv6

IPv6-address-ipv4-ipv6-and-addressing-explained) networks can use DHCPv6 (Stateful) or SLAAC (Stateless Address Autoconfiguration):

SLAAC: Devices generate their own [IPv6-address-ipv4-ipv6-and-addressing-explained) address](/learning-center/what-is-an-ip-address-IPv4-ipv6-and-addressing-explained) from the network prefix advertised by the router-network-address-translation-explained) and their own MAC address-address-resolution-protocol-explained). No DHCP server required.
DHCPv6 Stateful: Similar to IPv4-address-ipv4-IPv6-and-addressing-explained) DHCP — server assigns and tracks addresses.
DHCPv6 Stateless: router-network-address-translation-explained) advertises prefix via SLAAC; DHCPv6 provides DNS/NTP only.

Summary

DHCP automatically provides [IP address](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained), [subnet-explained) mask](/learning-center/what-is-subnetting-ip-subnets-and-cidr-explained), gateway, and DNS to connecting devices
The DORA process (Discover, Offer, Request, Acknowledge) happens over UDP-the-internets-core-protocol) via broadcast-address-resolution-protocol-explained)
Leases are temporary — devices renew before expiry; the server reclaims expired addresses
DHCP relay agents forward broadcasts across subnets to a central DHCP server
Rogue DHCP servers and starvation attacks are mitigated by DHCP Snooping and port-the-internets-core-protocol)-and-UDP-ports-explained) security
IPv6-address-ipv4-ipv6-and-addressing-explained) often uses SLAAC instead of DHCPv6, giving devices self-configured addresses