How does DHCP work?


DHCP stands for Dynamic Host Configuration Protocol and is the protocol utilised to issue dynamic IP addresses to hosts on the network. DHCP servers are configured to distribute, manage and update IP addresses on the network based on a conversation with a DHCP client. The DHCP client issues a request to the DHCP server, if both client and server are on different subnets of the network then a DHCP relay agent is used.

The components required for a successful DHCP architecture include a DHCP client, DHCP server and DHCP relay agent (if existing on different subnets of the network). IP addresses are issued to DHCP clients via a standard client/server method, where the DHCP client initiates a request to the DHCP server. When we say client, we are talking about any network connected device that is able to communicate with the DHCP server. Most Windows operating systems are supported from 2000 upwards.

The method by which DHCP clients obtain an IP address from the server is to simply locate and start a conversation with the server on the network and request an IP address that, if successful, is issued by the server. If the DHCP server cannot be found by the client then an automatic private IP address can be assigned from Microsofts class B network ( This IP address will be provided to the client only if there are no other clients on the network with this IP address. The DHCP client will test this on the network and accept the assigned IP address if this is the case. The DHCP client will then continue to beacon on the network for the DHCP server. If found, the DHCP client will drop their private address and be assigned an IP address by the DHCP server.

The DHCP server must be configured with an appropriate scope of IP addresses and TCP/IP parameters for clients within each subnet. For example, the administrator must configured the DHCP server with an IP address range and subnet mask. The administrator must also set the lease duration time dependant on the organisations requirements. For example, if the organisation only has a limited number of IP addresses available and a large number of devices or clients that join and leave the network regularly, then the administrator may wish to reduce the time of the lease so that DHCP returns unused addresses for redistribution. Finally, the administrator should configure the DHCP server to exclude static IP addresses present on the network from scope. For example, you may choose to exclude a certain IP address range from the scope of DHCP and utilise this address space for statically assigned servers on the network, if appropriate.

The interactions between client and server can be broadly compared to that of a TCP/IP connection. The client utilises a DHCPDiscover command to search for the DHCP server on the network. This is achieved by broadcasting the message to a specific subnet where the servers reside. The DHCP Server should pick up this command and issue a DHCPOffer command back to the client, which offers an IP address as configured by the administrator. The client then responds with a DHCPRequest command that requests the IP address offered and finally the server issues a DHCPPAck message to finalise the terms of the lease. This can be easily compared with shopping or an auction, as the seller you put out your product to a specific market, a potential buyer see’s the advert and comes back with an “offer” and you as the seller accept or decline and then the sale is finalised by the buyer presenting cash.

So, in a nutshell, that answers the question how does DHCP work? There are a lot more points to remember than that though so its worth checking out some of the Microsoft documentation, which you can find here:

About Lee Hazell

Lee Hazell is a cyber security consultant with a keen interest in anything tech or security related. Follow Lee on .

Leave a Reply

Your email address will not be published. Required fields are marked *