What Is DHCP? How Dynamic Host Configuration Protocol Works

Last Updated: October 2026

Every time you connect your phone to Wi-Fi, plug an Ethernet cable into your laptop, or boot up a smart TV, the device needs an IP address before it can communicate on the network. You do not type one in manually — it just appears. The technology responsible for this seamless experience is DHCP (Dynamic Host Configuration Protocol), and it is running silently in the background of virtually every network on the planet.

In this guide, we will explain exactly what DHCP does, walk through the four-step DORA process, explore lease management, cover DHCP options and scopes, compare DHCP reservation to static IP, discuss DHCPv6 and SLAAC for IPv6, and provide practical troubleshooting steps for common DHCP problems.

What DHCP Does

DHCP is a client-server protocol defined in RFC 2131. Its job is to automatically assign network configuration parameters to devices (called “clients”) when they connect to a network. The parameters typically include:

• IP address — a unique address on the local network (e.g., 192.168.1.105).
• Subnet mask — defines the size of the local network (e.g., 255.255.255.0 or /24). See our subnet mask guide for details.
• Default gateway — the router's IP address, used to reach destinations outside the local subnet.
• DNS servers — the addresses of name servers that resolve domain names to IP addresses.

Without DHCP, a network administrator would have to visit every single device and manually enter these settings. On a home network with 20 devices, that is tedious. On a corporate network with thousands of devices, it would be impossible. DHCP automates the entire process and tracks which addresses are in use, preventing conflicts.

The DORA Process: How DHCP Assigns an IP Address

When a device joins a network and needs an IP address, it engages in a four-step exchange with the DHCP server known as DORA:

1. Discover

The client does not yet have an IP address, so it cannot send a targeted message. Instead, it broadcasts a DHCPDISCOVER message to the entire network segment on UDP port 67. The message essentially says: “Is there a DHCP server out there? I need an IP address.” The source IP is 0.0.0.0 (the client has no address yet) and the destination is 255.255.255.255 (broadcast).

2. Offer

Any DHCP server on the network that receives the Discover message responds with a DHCPOFFER. This message contains a proposed IP address, the subnet mask, the lease duration, and the server's own IP address. If multiple DHCP servers exist on the network, the client may receive multiple offers — it typically accepts the first one it receives.

3. Request

The client selects one of the offers and broadcasts a DHCPREQUEST message, indicating which server's offer it is accepting. This broadcast serves two purposes: it confirms the chosen server's offer and informs any other DHCP servers that their offers were declined, so they can return those addresses to their available pool.

4. Acknowledge

The selected DHCP server responds with a DHCPACK (acknowledge), confirming the IP address assignment and providing the full configuration (subnet mask, gateway, DNS servers, lease time, and any additional DHCP options). The client applies the configuration and is now fully connected to the network.

If the server determines the address is no longer available (perhaps another device claimed it in the meantime), it sends a DHCPNAK (negative acknowledge), and the client must restart the DORA process.

DHCP Lease Time

A DHCP lease is not permanent — it has an expiration time. The lease time determines how long a device can use its assigned IP address before it must renew the lease. This mechanism ensures that IP addresses are returned to the pool when devices disconnect, preventing address exhaustion.

How Lease Renewal Works

The renewal process happens automatically in the background:

• At 50% of the lease time (T1): The client sends a unicast DHCPREQUEST directly to the server that assigned the lease, requesting a renewal. If the server responds with a DHCPACK, the lease is renewed for a new full duration.
• At 87.5% of the lease time (T2): If the original server did not respond, the client broadcasts a DHCPREQUEST to any available DHCP server on the network. This provides a fallback if the original server is down.
• At 100% (lease expiration): If no server responded, the client must release the IP address and start the DORA process from scratch. The device temporarily loses its network configuration.

Choosing the Right Lease Time

The optimal lease time depends on the network:

• Short leases (1–4 hours): Best for networks with high device turnover — coffee shops, conference centers, airports. Addresses are reclaimed quickly when devices leave.
• Medium leases (8–24 hours): Suitable for most home and office networks. Devices that stay connected all day will renew seamlessly, and addresses are reclaimed overnight.
• Long leases (2–8 days): Appropriate for stable networks with few devices and large address pools. Reduces DHCP traffic but means addresses are tied up longer after a device disconnects.

DHCP Servers: Where DHCP Runs

The DHCP server is the software (or hardware) that manages the address pool and responds to client requests. Common DHCP servers include:

Home Routers

Every consumer router includes a built-in DHCP server. It is enabled by default and manages the local network's address pool (e.g., 192.168.1.100 – 192.168.1.200). You can configure the pool range, lease time, DNS servers, and DHCP reservations through the router's admin panel. For most home users, the router's DHCP server is all you need.

Windows Server DHCP

In enterprise environments, Windows Server includes a DHCP Server role that provides advanced features: multiple scopes, superscopes, failover with a partner server, DHCP policies, scope-level and server-level options, integration with Active Directory for authorization, and detailed logging and auditing. The DHCP Management Console provides a GUI for configuration and monitoring.

Linux DHCP Servers (ISC DHCP, Kea, dnsmasq)

On Linux, several DHCP server implementations are available:

• ISC DHCP (dhcpd): The classic, widely-used DHCP server. Configured via /etc/dhcp/dhcpd.conf. Feature-rich and well-documented, though ISC ended active development in favor of Kea.
• ISC Kea: The modern replacement for ISC DHCP. Uses a JSON configuration format, supports MySQL/PostgreSQL backends for lease storage, and provides a REST API for management. Designed for high-performance environments.
• dnsmasq: A lightweight DNS and DHCP server often used on small Linux servers, Raspberry Pi setups, and embedded devices. Simple to configure and perfect for home lab environments.

DHCP Options

Beyond the basic IP address and subnet mask, DHCP can deliver dozens of additional configuration parameters to clients through DHCP options. Each option is identified by a number. The most commonly used options include:

Vendors can also define custom DHCP options for proprietary features. For example, VoIP phones use vendor-specific options to receive the address of their provisioning server.

DHCP Reservation vs. Static IP

Both DHCP reservation and static IP achieve the same goal: a device always gets the same IP address. However, they work differently and have distinct trade-offs:

DHCP Reservation

• Configured on the DHCP server (router or server).
• The device uses DHCP normally — it sends a Discover, and the server responds with the reserved IP based on the device's MAC address.
• The device also receives the correct subnet mask, gateway, and DNS automatically.
• If you change the gateway or DNS on the server, the device picks up the change at the next lease renewal — no manual update needed on the device.
• All reservations are managed in one central location.

Static IP (Device-Side)

• Configured directly on the device.
• The device does not use DHCP at all — it announces its own IP address.
• You must manually enter the subnet mask, gateway, and DNS on the device.
• If the network changes (different gateway, different DNS), you must update the device manually.
• Can cause conflicts if the DHCP server is unaware of the assignment and gives the same IP to another device.

Recommendation: Use DHCP reservation whenever possible. Reserve static IPs configured on the device for situations where DHCP reservation is not available (e.g., some IoT devices that require manual IP configuration, or servers that must boot with an IP before the DHCP server is available).

DHCP Relay

DHCP uses broadcast messages, which by default do not cross router boundaries. This means a DHCP server on one subnet cannot serve clients on a different subnet — unless a DHCP relay agent is configured.

A DHCP relay agent runs on the router connecting two subnets. When it receives a DHCPDISCOVER broadcast on one subnet, it converts it into a unicast message and forwards it to the DHCP server on the other subnet. The server processes the request and sends the response back through the relay agent. This allows a single centralized DHCP server to manage IP addresses across multiple subnets and VLANs — essential in enterprise networks with dozens or hundreds of network segments.

On Cisco routers, the relay is configured with the ip helper-address command on each interface. On Linux, the dhcrelay or kea-dhcp-relay service performs the same function.

DHCP Scope and Address Pools

A DHCP scope defines the range of IP addresses that the DHCP server is authorized to assign. Each scope corresponds to a single subnet and includes:

• Address pool: The range of IP addresses available for assignment (e.g., 192.168.1.100 – 192.168.1.200).
• Subnet mask: The mask for the subnet (e.g., 255.255.255.0).
• Exclusion ranges: Addresses within the pool that are reserved and should not be assigned (e.g., addresses used by the router, servers, or printers with static IPs).
• Lease duration: How long each assignment lasts.
• DHCP options: Default gateway, DNS servers, domain name, and other options specific to this scope.

In enterprise DHCP servers (Windows Server, ISC Kea), you can define multiple scopes — one per subnet. A superscope groups multiple scopes together, useful when a single physical network spans multiple logical subnets (multinetting).

DHCP and IPv6: DHCPv6 vs. SLAAC

IPv6 networks have two mechanisms for automatic address configuration, and they work differently from IPv4's DHCP:

SLAAC (Stateless Address Autoconfiguration)

SLAAC allows devices to generate their own IPv6 address without any server. The router periodically broadcasts Router Advertisement (RA) messages containing the network prefix (e.g., 2001:db8:abcd:1::/64). The device combines this prefix with an interface identifier — traditionally derived from the MAC address using the EUI-64 process, or a randomly generated value for privacy — to create a globally unique IPv6 address.

SLAAC is simple and does not require any server infrastructure. However, it has limitations: it cannot assign DNS servers (unless combined with RDNSS options in Router Advertisements, which not all clients support), and the server has no record of which addresses are in use.

DHCPv6 (Stateful)

DHCPv6 works similarly to DHCPv4 — a server assigns IPv6 addresses and options to clients. It provides central management, address tracking, and the ability to assign DNS servers, NTP servers, and other options that SLAAC cannot. DHCPv6 uses a different port (UDP 546/547) and a different message format than DHCPv4, but the concept is the same.

Managed vs. Other Configuration Flags

The router's RA messages include two flags that tell clients how to configure themselves:

• M (Managed) flag = 1: Tells clients to use DHCPv6 for address assignment.
• O (Other) flag = 1: Tells clients to use DHCPv6 for additional options (like DNS) but to use SLAAC for the address itself.
• Both flags = 0: Clients use SLAAC only.

Many networks use SLAAC for address assignment with DHCPv6 for DNS and other options (M=0, O=1) — this provides the simplicity of SLAAC with the configuration richness of DHCPv6.

Troubleshooting DHCP Problems

169.254.x.x Address (APIPA)

If your device shows an IP address in the 169.254.0.0/16 range, it means the DHCP process failed. The device used APIPA (Automatic Private IP Addressing) to assign itself a link-local address so it can still communicate with other APIPA devices on the same segment, but it cannot reach the internet or other subnets.

Common causes and fixes:

1. Check the physical connection. Is the Ethernet cable plugged in securely? Is Wi-Fi connected to the correct network? A loose cable or failed Wi-Fi association is the most common cause.
2. Restart the DHCP server. Reboot your router. If you are using a dedicated DHCP server, check that the DHCP service is running.
3. Release and renew the lease. On Windows: ipconfig /release then ipconfig /renew. On Linux: sudo dhclient -r && sudo dhclient. On macOS: Go to System Settings > Network > select the connection > Details > TCP/IP > Renew DHCP Lease.
4. Check the DHCP pool. If all addresses in the pool are leased, the server cannot offer new addresses. Increase the pool size or shorten lease times to reclaim addresses faster.
5. Check for a rogue DHCP server. Multiple DHCP servers on the same network can cause conflicts. See the security section below.

IP Address Conflicts

A DHCP server tracks which addresses are leased and should not assign duplicates. However, conflicts can occur if:

• A device has a static IP that falls within the DHCP pool range.
• Two DHCP servers are running on the same network with overlapping pools.
• A device did not release its lease before disconnecting, and the server assigned the address to another device after the lease expired while the first device was still using it (rare but possible with very short leases and network issues).

To resolve, identify the conflicting devices (check the router's ARP table and DHCP lease list), change one device's IP, and ensure static IPs are outside the DHCP pool.

Slow or Delayed IP Assignment

If devices take a long time to get an IP address, possible causes include:

• Network congestion: Heavy broadcast traffic can delay DHCP packets.
• DHCP server overloaded: In large networks, the server may be slow to respond if it is processing many requests simultaneously.
• STP (Spanning Tree Protocol): On managed switches, STP can delay port activation by 30–50 seconds after a cable is plugged in. Enable PortFast on access ports to eliminate this delay.
• Wireless interference: On Wi-Fi, interference or weak signals can cause DHCP packets to be lost, leading to retransmissions and delays.

DHCP Security Concerns

Rogue DHCP Servers

A rogue DHCP server is an unauthorized server on the network that responds to client Discover messages with malicious configuration — typically pointing the default gateway or DNS server to an attacker-controlled machine. This enables man-in-the-middle attacks where the attacker can intercept, modify, or monitor all traffic from affected devices.

Defense: On managed switches, enable DHCP snooping. This feature designates specific switch ports as “trusted” (connected to legitimate DHCP servers) and drops DHCP server messages from all other ports. On home networks, ensure only your router is running a DHCP server — if you plug in a second router, make sure its DHCP server is disabled or the device is in bridge/access point mode.

DHCP Starvation Attacks

In a DHCP starvation attack, an attacker floods the DHCP server with Discover messages using spoofed MAC addresses, exhausting the entire address pool. Legitimate devices then cannot obtain IP addresses. This is a denial-of-service attack against the DHCP infrastructure.

Defense: Enable port security on managed switches to limit the number of MAC addresses per port. Combined with DHCP snooping and rate limiting, this prevents a single device from exhausting the pool.

Frequently Asked Questions

What does DHCP do?

DHCP automatically assigns IP addresses and other network configuration parameters — subnet mask, default gateway, and DNS servers — to devices when they join a network. Without DHCP, every device would need to be manually configured with a unique IP address.

What is the DORA process in DHCP?

DORA stands for Discover, Offer, Request, Acknowledge — the four-step handshake between a client and a DHCP server. The client broadcasts a Discover, the server responds with an Offer containing an available IP, the client formally Requests that IP, and the server sends an Acknowledge confirming the lease.

What is a DHCP lease time?

A DHCP lease time is the duration for which a device is allowed to use its assigned IP address. When the lease expires, the device must renew it (which usually happens automatically at the halfway point). Common lease times range from 1 hour to 8 days depending on the network environment.

What is the difference between DHCP reservation and a static IP?

A DHCP reservation is configured on the server (router) to always assign the same IP to a specific MAC address. The device still uses DHCP. A static IP is configured on the device itself — it does not use DHCP at all. DHCP reservation is easier to manage centrally and automatically provides gateway and DNS settings.

Why does my device have a 169.254.x.x address?

A 169.254.x.x address means your device tried to contact a DHCP server but received no response. This is called APIPA (Automatic Private IP Addressing). Check your cable connection, ensure your router is running, and try releasing and renewing the DHCP lease with ipconfig /release and ipconfig /renew on Windows.

What is DHCPv6 and how does it differ from SLAAC?

DHCPv6 is the IPv6 version of DHCP — a server assigns IPv6 addresses and options. SLAAC (Stateless Address Autoconfiguration) lets devices generate their own IPv6 address from the router's advertised prefix without any server. SLAAC is simpler but provides less control. Many networks use SLAAC for addresses and DHCPv6 for additional options like DNS.

What is a rogue DHCP server?

A rogue DHCP server is an unauthorized server on a network that hands out incorrect configuration — often pointing to a malicious DNS server or gateway. It can be accidental (a second router with DHCP enabled) or intentional (a man-in-the-middle attack). DHCP snooping on managed switches is the standard defense.

Can I run multiple DHCP servers on the same network?

Yes, but each server must manage a non-overlapping pool of addresses. In enterprise environments, DHCP failover configurations provide redundancy. On home networks, having two DHCP servers (e.g., your router and a second router not in bridge mode) usually causes problems and should be avoided.