DHCP

Why it exists

Every host on an IP network needs an address that is unique on its subnet, a mask, a gateway and a resolver. Assigning those by hand works until a person has to do it twice, and it fails completely for anything mobile — a laptop that moves between two buildings needs different values in each.

BOOTP solved the bootstrap half in 1985 with a static table mapping MAC addresses to addresses. DHCP keeps its message format, its ports and most of its header, and adds the part that matters: allocation from a pool, for a bounded time, that the client renews or loses. RFC 2131 §1IntroductionRFC 2131 · DRAFT STANDARD · March 1997

The lease is the design. An address that expires means a network that reclaims addresses from devices that left without saying so, which is what makes a pool smaller than the population workable.

Four messages to get an address

A client with nothing broadcasts, hears an offer, asks for it by name, and is confirmed. The fourth message is what makes the lease exist.

How it works

Four messages: DISCOVER, OFFER, REQUEST, ACK. The first three are broadcast, because until the last one there is no agreed address to unicast to and, in the REQUEST, because the servers that were not chosen need to hear that they were not chosen. RFC 2131 §3.1Client-server interaction - allocating a network addressRFC 2131 · DRAFT STANDARD · March 1997

The message type is option 53. The header carries only `op`, which distinguishes a request from a reply — a BOOTP field that survived because the format did. Almost everything a client actually receives is an option, and the fixed header is mostly there for compatibility. RFC 2132 §9.6DHCP Message TypeRFC 2132 · DRAFT STANDARD · March 1997

A broadcast does not cross a router, so on any network with more than one subnet a relay agent forwards the message and writes its own interface address into giaddr. The server selects a scope by matching giaddr, which makes the relay — not the client and not the server — the thing that decides which subnet a host lands in. RFC 2131 §2Protocol SummaryRFC 2131 · DRAFT STANDARD · March 1997

The lease runs on two timers. At T1, half the lease by default, the client unicasts a renewal to the server that granted it. At T2, seven eighths, it gives up on that server and broadcasts to any. Only when the lease itself expires does it stop using the address. RFC 2132 §9.11Renewal (T1) Time ValueRFC 2132 · DRAFT STANDARD · March 1997

The options area is 312 octets in a minimum-sized message, and a relay adding option 82 spends part of a budget the scope’s author never saw. Overflow truncates silently. RFC 2132 §9.3Option OverloadRFC 2132 · DRAFT STANDARD · March 1997

Try it

On the wire

Constructed examples, encoded from the field table below them — not captured traffic.

Configure it

When it breaks

Symptom first, because that is what you have when it happens.

1. A client gets an address, but from the wrong subnet, with a gateway it cannot reach. The interface is up and everything looks configured.

   Narrow it down

   1. Capture at the server and read giaddr in the relayed DISCOVER.
   2. Compare it with the gateway address of the VLAN the client is actually in.
   3. Check which interface the helper or forwarder statement is configured under.

   Cause

   The relay sourced giaddr from the wrong interface, so the server matched the wrong scope. Both devices behaved correctly.

   Fix

   Configure the relay on the SVI facing the clients, one statement per client VLAN.

   RFC 2131 §2Protocol SummaryRFC 2131 · DRAFT STANDARD · March 1997

2. The client falls back to a link-local address and no lease appears anywhere.

   Narrow it down

   1. Confirm the port is in the VLAN you think it is, and that the VLAN reaches the relay.
   2. Check for a helper address on the client-facing SVI at all.
   3. Look for DHCP snooping dropping the request because the port is untrusted.
   4. Confirm the pool is not simply empty.

   Cause

   The broadcast never reached a server, or reached one with nothing to give. A missing relay statement and an exhausted pool present identically from the client.

   Fix

   Work outward from the client: VLAN, relay, reachability, then pool utilisation.

3. An option configured in the scope never arrives. Common with boot filenames, so it presents as a PXE or TFTP fault.

   Narrow it down

   1. Capture the ACK and count the octets in the options area.
   2. Check whether a relay is inserting option 82 and how large it is.
   3. Confirm the client asked for the option in its parameter request list.

   Cause

   The reply exceeded the options area and was truncated, or the client never requested the option and the server omitted it.

   Fix

   Trim the scope to what clients request, enable option overload, or raise the message size. Removing options nobody asked for is usually enough.

   RFC 2132 §9.8Parameter Request ListRFC 2132 · DRAFT STANDARD · March 1997

4. Two hosts hold the same address. One or both lose connectivity intermittently as ARP entries flap.

   Narrow it down

   1. Look for DHCPDECLINE in the server log — the client that probed and found a conflict.
   2. Check whether a statically configured device sits inside the dynamic range.
   3. Check for a second DHCP server on the segment.

   Cause

   The pool overlaps something the server does not know about: a static address, or another allocator.

   Fix

   Exclude the static range from the pool, or convert the static addresses to reservations so the allocator can see them.

   RFC 2131 §4.4DHCP client behaviorRFC 2131 · DRAFT STANDARD · March 1997

5. Some clients get a plausible address and a gateway that is not the real one. Which clients are affected changes between reboots.

   Narrow it down

   1. Compare the server identifier in option 54 against the real server’s address.
   2. Trace the MAC in the offer back through the address table to a port.
   3. Check whether DHCP snooping is enabled and which ports are trusted.

   Cause

   Another device on the segment is answering DISCOVER. Whichever reply arrives first wins, so the outcome is a race.

   Fix

   Enable DHCP snooping and trust only the ports toward legitimate servers. Untrusted ports then have their server-class replies dropped.

Design notes

Lease length is a trade between churn and reclaim speed. Long leases mean stable addresses and slow recovery of a pool after an event; short leases mean the opposite plus more renewal traffic. A guest wireless network wants hours; a data centre wants days.

Reservations are better than static addresses for anything that must keep an address. A static address configured on the device is invisible to the server, which will eventually hand it to someone else; a reservation is the same outcome recorded where the allocator can see it.

Two servers with the same scope and no coordination will both allocate from it and eventually collide. Either split the pool between them — the classic 80/20 — or run a protocol that shares state. Splitting is simpler and loses only capacity.

DHCP has no authentication worth the name. A host on the segment can answer faster than the real server and become the gateway for everything that believed it. DHCP snooping on the access switch, permitting server replies only on the ports where a server actually is, is the control.

Misconceptions

“The DHCP server decides which subnet a client belongs to.”

The relay does. The server matches a scope against giaddr, which the relay wrote. A correctly configured server behind a misconfigured relay hands out correct addresses from the wrong subnet all day. RFC 2131 §2Protocol SummaryRFC 2131 · DRAFT STANDARD · March 1997

“Once the client has an offer, it replies directly to that server.”

The initial REQUEST is broadcast. It has to be, so servers whose offers were declined can release the addresses they reserved. Renewals at T1 are unicast — those are a different message in a different state. RFC 2131 §3.1Client-server interaction - allocating a network addressRFC 2131 · DRAFT STANDARD · March 1997

“When a lease expires the client loses its address.”

Long before that. The client renews at half the lease and again at seven eighths; reaching expiry means every renewal failed. A client that lost its address did not have a lease problem, it had a reachability problem for at least half a lease. RFC 2132 §9.12Rebinding (T2) Time ValueRFC 2132 · DRAFT STANDARD · March 1997

“siaddr is the address of the DHCP server.”

It is the next server in a bootstrap sequence — a TFTP server, in practice. The DHCP server identifies itself in option 54. Reading siaddr as the server identifier is a routine cause of PXE clients trying to boot from 0.0.0.0. RFC 2131 §2Protocol SummaryRFC 2131 · DRAFT STANDARD · March 1997

More walkthroughs

Terms

Lease

A binding between a client and an address, valid for a stated time. The client renews at half the lease and again at seven eighths; reaching expiry means every renewal failed.

Relay agent

A router that forwards DHCP between a client broadcast domain and a server elsewhere, recording the interface it came from in giaddr.

giaddr

The relay agent address field. The server matches it against its scopes, so this one field decides which subnet a client is allocated from.

Scope

A server-side pool of addresses for one subnet, with the options that go with it. Selected by giaddr, not by anything the client says.

Option overload

Option 52, which declares that the sname and file header fields carry options instead of their usual contents — 192 extra octets when the 312-octet options area is full.

Check yourself

• Where does a DHCP message say whether it is a DISCOVER or a REQUEST?

  • In the op field of the fixed header
  • In option 53
  • In the UDP source port
  • In the xid field
• What does a DHCP server use to choose which scope to allocate from?

  • The client’s MAC address in chaddr
  • The VLAN tag on the incoming frame
  • giaddr, written by the relay agent
  • The source IP address of the request
• Two servers offer an address. How does the one that loses find out?

  • The client sends it a DHCPDECLINE
  • It times out with no notification
  • It hears the broadcast REQUEST naming the other server
  • The winning server tells it
• A client holds an 8-hour lease. When does it first try to renew?

  • After 8 hours
  • After 7 hours
  • After 4 hours
  • Every 30 minutes
• A scope defines option 42 for NTP but clients never receive it. Most likely cause?

  • Option 42 is not valid for IPv4
  • The clients did not list it in option 55
  • The relay strips it
  • It conflicts with option 51
• A scope sends both option 3 (Router) and option 121 (Classless Static Route). What does a compliant client do?

  • Merges both sets of routes
  • Uses option 3 and ignores option 121
  • Ignores option 3 entirely
  • Rejects the message as malformed
• A client completes DORA, then immediately sends DHCPDECLINE and starts over. What did it find?

  • The lease was too short
  • Another host already answers for the address it was given
  • The server was not authoritative for the subnet
  • A required option was missing
• How does a server’s reply find its way back to a relayed client?

  • The server broadcasts it on the client’s subnet
  • It is unicast to the giaddr, and the relay forwards it onto the segment it came from
  • The client polls the server
  • It follows the route to the client’s new address

Related

• VLANs

  Splits one physical switched network into several independent broadcast domains, and carries them over a shared link with a four-octet tag.