Skip to content
IT Atlas

Networking · Protocols

DHCP

Dynamic Host Configuration Protocol automatically issues IP addresses and network configuration to clients as they join a network.

FoundationalUpdated 2026-09-01

Overview

DHCP removes manual addressing. A client broadcasts for configuration, a server offers an address from a scope, and the client leases it for a defined period along with options such as default gateway, DNS servers, NTP servers and domain search suffix.

Because it is broadcast based, DHCP is scoped to a broadcast domain. Routed networks either run a server per VLAN or, far more commonly, configure a DHCP relay agent (IP helper) that forwards requests to a central server.

How it works

  1. 01Scopes define the address range, exclusions, lease duration and options for a subnet.
  2. 02Reservations bind a specific address to a client identifier, usually a MAC address, so that a device receives a stable address while still being centrally managed.
  3. 03Relay agents insert option 82 information so a central server can select the correct scope for a remote subnet.
  4. 04In Windows environments DHCP is frequently paired with dynamic DNS registration so that leased addresses appear in DNS automatically.

Why it matters

  • Addressing errors are among the fastest ways to take a site offline; centralised DHCP makes them visible and reversible.
  • Lease data is an inventory source, it tells you what actually appeared on the network and when.
  • Options delivery keeps clients pointed at the correct resolvers, which underpins authentication and name resolution.

Sequence

DORA lease process
  1. 1DISCOVER, client broadcasts a request
  2. 2OFFER, server proposes an address and options
  3. 3REQUEST, client formally requests the offered address
  4. 4ACK, server confirms and records the lease

Renewal occurs at 50% of lease time (T1) directly with the leasing server, and rebinding at 87.5% (T2) by broadcast.

Security considerations

  • Rogue DHCP servers can redirect clients to attacker controlled gateways and resolvers. Enable DHCP snooping on access switches and trust only uplink ports.
  • Scope exhaustion is a simple denial of service; alert on high utilisation and unusually short lived leases.
  • Do not rely on MAC based reservations as a security control, MAC addresses are trivially spoofed. Use 802.1X for access control.

Common misconfigurations

  • Overlapping scopes across two servers without split scope or failover configuration, producing duplicate addresses.
  • Missing IP helper on a new VLAN, so clients fall back to link local addressing.
  • Static devices configured inside the dynamic range without exclusions.
  • Lease times of many days on guest or high churn networks, exhausting the pool.

Primary sources