DHCP

Lesson 8: DHCP

DHCP stands for Dynamic Host Configuration
Protocol. It is a networking protocol that allows devices
to obtain network configuration automatically.

When a computer, smartphone, printer, server or other network device
connects to a network, it may need several pieces of information before
it can communicate properly.

This can include:

• IP address
• Subnet mask
• Default gateway
• DNS server
• Lease duration
• Other network configuration options

Instead of manually entering these values on every device, DHCP can
automatically provide them.

1. Why DHCP Is Important

Imagine an organization with hundreds or thousands of computers.
Manually configuring an IP address, subnet mask, gateway and DNS server
on every device would be time-consuming and could introduce errors.

DHCP centralizes much of this configuration.

DHCP helps organizations:

• Automatically assign IP addresses.
• Reduce manual configuration.
• Reuse addresses when devices leave a network.
• Provide consistent network settings.
• Manage address pools.
• Support large networks.

2. DHCP Client and DHCP Server

DHCP normally operates using a client-server model.

The DHCP client is the device requesting network
configuration.

The DHCP server manages available configuration
information and responds to DHCP requests.

DHCP Client
     |
     | DHCP Request
     v
DHCP Server
     |
     | Network Configuration
     v
DHCP Client

The DHCP server may be a dedicated server, a router, a firewall,
or another network appliance.

3. The DHCP DORA Process

The basic DHCP address-assignment process is commonly remembered using
the word DORA.

• D — Discover
• O — Offer
• R — Request
• A — Acknowledgement

The process can be represented as:

Client                         DHCP Server

  |                                |
  |------ DHCP DISCOVER ---------->|
  |                                |
  |<------- DHCP OFFER ------------|
  |                                |
  |------ DHCP REQUEST ----------->|
  |                                |
  |<---- DHCP ACKNOWLEDGEMENT ------|
  |                                |

4. DHCP Discover

When a device needs an IP configuration, it can send a
DHCP Discover message to locate available DHCP servers.

At this point the client may not yet have a usable IP address for
normal network communication.

The Discover message helps the client announce that it needs network
configuration.

5. DHCP Offer

A DHCP server that receives the Discover message may respond with a
DHCP Offer.

The offer can contain information such as:

• Proposed IP address
• Subnet mask
• Lease duration
• Default gateway
• DNS server
• Other DHCP options

6. DHCP Request

The client sends a DHCP Request to indicate that it
wants to use the offered configuration.

The request also helps DHCP servers determine which offer was accepted.

7. DHCP Acknowledgement

The DHCP server can respond with a
DHCP Acknowledgement, commonly called DHCP ACK.

The ACK confirms the configuration and lease.

The client can then configure its network interface with the supplied
information.

8. DHCP Lease

A DHCP-assigned IP address is normally provided as a
lease.

A lease defines the period during which the client may use the assigned
address under the DHCP configuration.

For example:

IP Address: 192.168.1.25
Lease Time: 8 hours

Before the lease expires, the client can attempt to renew it.

Lease management helps networks reuse IP addresses efficiently.

9. DHCP Scope

A DHCP scope is a configured range of addresses that
a DHCP server can assign to clients.

For example:

Network:       192.168.1.0/24

DHCP Pool:
192.168.1.100
to
192.168.1.200

In this example, the server can assign addresses from the configured
pool while other addresses may be reserved for servers, network
devices or other purposes.

10. DHCP Reservations

A DHCP reservation allows a particular device to consistently receive
a specific IP address based on an identifier such as its MAC address.

For example:

Device MAC:
AA:BB:CC:DD:EE:FF

Reserved IP:
192.168.1.50

Reservations can be useful for printers, access points, cameras and
other devices that need predictable addressing while still being
managed through DHCP.

11. Common DHCP Options

DHCP can provide more than just an IP address.

Common configuration information includes:

• Subnet mask
• Default gateway
• DNS servers
• Lease duration
• Domain name
• Other network-specific configuration

The exact options used depend on the network environment and DHCP
implementation.

12. DHCP and the Default Gateway

The default gateway is the device a host normally uses when it needs
to communicate outside its local network.

For example:

Client:
192.168.1.25

Gateway:
192.168.1.1

Internet:
     |
     v
192.168.1.1
     |
     v
External Networks

DHCP can automatically provide the gateway address to clients.

13. DHCP and DNS

DHCP and DNS perform different jobs but commonly work together.

DHCP provides network configuration, while DNS resolves names into
network information.

DHCP
 |
 +---- IP Address
 |
 +---- Gateway
 |
 +---- DNS Server
          |
          v
         DNS
          |
          v
   Domain Resolution

A workstation may receive the address of its DNS resolver through DHCP
and then use that resolver to translate domain names.

14. DHCP vs Static IP Addressing

Both approaches have legitimate uses. The correct choice depends on
the network's architecture and operational requirements.

15. DHCP and Security

DHCP is part of the network infrastructure and therefore has security
implications.

If an attacker can interfere with DHCP communications, they may attempt
to influence how devices configure their network connections.

This makes DHCP an important technology for cybersecurity professionals
to understand.

16. Rogue DHCP Servers

A rogue DHCP server is an unauthorized DHCP server
operating on a network.

A rogue server may provide clients with incorrect configuration.

For example, it could attempt to provide:

• An incorrect default gateway.
• An unauthorized DNS server.
• Incorrect network information.
• Other manipulated DHCP options.

This can disrupt connectivity or redirect network traffic.

Organizations should use appropriate network controls to prevent
unauthorized DHCP servers from serving clients.

17. DHCP Starvation

DHCP starvation is an attack in which an attacker
attempts to consume available addresses from a DHCP pool.

If the pool becomes exhausted, legitimate devices may have difficulty
obtaining an IP address.

At an introductory level, students should understand the concept and
the defensive controls rather than attempting the attack on a network.

18. DHCP Snooping

DHCP snooping is a network-switch security feature
designed to help distinguish legitimate DHCP server traffic from
unauthorized DHCP server traffic.

Ports can be configured according to whether DHCP server traffic is
expected.

A simplified model is:

Trusted Port
     |
     v
DHCP Server

Untrusted Ports
     |
     v
Client Devices

The exact implementation depends on the switch manufacturer and
network configuration.

19. DHCP Snooping and IP-MAC Information

Some network switches can build DHCP snooping binding information
that associates details such as:

• IP address
• MAC address
• VLAN
• Switch port
• Lease information

This information can support other network security mechanisms and
help administrators investigate suspicious network activity.

20. DHCP and MAC Addresses

DHCP and MAC addresses are closely related during network configuration.

The MAC address identifies a network interface at the data-link layer,
while DHCP operates to provide IP configuration at the network layer
and above.

Network Interface
       |
       | MAC Address
       v
DHCP Communication
       |
       v
IP Address
       |
       v
Network Communication

Security analysts can sometimes correlate DHCP records with switch
and endpoint information to determine which device used a particular
IP address at a particular time.

21. DHCP and Cybersecurity Investigations

Suppose a security team sees suspicious traffic from:

192.168.1.75

The IP address alone may not identify the physical device or user.

Investigators may examine DHCP records to determine which device held
that IP address during the relevant period.

They may correlate:

• Timestamp
• IP address
• MAC address
• DHCP lease
• Switch port
• VLAN
• Endpoint logs

This demonstrates why DHCP logs can be valuable evidence during an
incident investigation.

22. DHCP Troubleshooting

If a computer cannot connect properly to a network, DHCP configuration
is one area that may need investigation.

Possible questions include:

• Did the device receive an IP address?
• Is the address within the expected subnet?
• Is the subnet mask correct?
• Is the default gateway correct?
• Is the DNS server correct?
• Is the DHCP server reachable?
• Has the DHCP pool become exhausted?
• Is there an unauthorized DHCP server?

23. Windows DHCP Information

On Windows, the following command can display IP configuration:

ipconfig /all

Useful information can include:

• DHCP Enabled
• IPv4 Address
• Subnet Mask
• Default Gateway
• DHCP Server
• DNS Servers
• Lease Obtained
• Lease Expires

This makes ipconfig /all an important command for basic
network troubleshooting.

24. Windows DHCP Renewal Commands

On an authorized Windows system, a client can release and renew its
DHCP configuration.

ipconfig /release
ipconfig /renew

These commands should be used carefully on production systems because
releasing an address can temporarily affect network connectivity.

25. Linux DHCP Information

On Linux, network configuration can be inspected using commands such as:

ip addr
ip route

The exact DHCP client implementation depends on the Linux distribution
and network-management system.

Administrators may also inspect the system's network-management logs
to understand DHCP events.

26. DHCP Security Best Practices

• Use authorized DHCP servers.
• Restrict access to network infrastructure.
• Enable DHCP snooping where supported and properly configured.
• Separate network segments using appropriate VLANs.
• Monitor DHCP server logs.
• Monitor for unexpected DHCP servers.
• Protect network switches and management interfaces.
• Use appropriate port-security controls where required.
• Maintain accurate time synchronization for investigation.
• Review unusual address-allocation activity.
• Document DHCP scopes and reservations.

27. Example PHP Network Configuration

PHP applications can represent network configuration information
for dashboards, reports or educational systems.

<?php

$network_info = array(
    'ip_address'  => '192.168.1.25',
    'subnet_mask' => '255.255.255.0',
    'gateway'     => '192.168.1.1',
    'dns_server'  => '192.168.1.1',
);

foreach ( $network_info as $key => $value ) {

    $label = ucwords(
        str_replace( '_', ' ', $key )
    );

    echo '<strong>' .
        htmlspecialchars(
            $label,
            ENT_QUOTES,
            'UTF-8'
        ) .
        ':</strong> ' .
        htmlspecialchars(
            $value,
            ENT_QUOTES,
            'UTF-8'
        ) .
        '<br>';
}
?>

The example uses HTML escaping before displaying values. In a real
application, network information should be obtained from trusted
sources and access to sensitive infrastructure information should be
properly controlled.

28. Practical Lab — Inspect Your DHCP Configuration

Perform this exercise only on your own computer or an authorized
training network.

Windows

Run:

ipconfig /all

Identify:

• IPv4 address
• Subnet mask
• Default gateway
• DHCP server
• DNS servers
• Lease obtained time
• Lease expiration time

Linux

Run:

ip addr
ip route

Record the assigned address and default route.

29. Practical Lab — DHCP Investigation Scenario

Imagine that several users suddenly receive incorrect network
configuration.

One possible investigation process is:

1. Check the affected devices' IP configuration.
2. Identify the DHCP server being reported by clients.
3. Compare the reported DHCP server with the authorized server.
4. Check DHCP server logs.
5. Inspect switch configuration.
6. Check for unauthorized devices.
7. Review DHCP snooping information if available.
8. Correlate timestamps with network events.

The objective is to identify the source of the configuration problem
without making unsupported assumptions.

30. Security Scenario

A company's employees suddenly report that websites are opening
slowly or resolving incorrectly.

A security analyst notices that several workstations are receiving a
DNS server address that is different from the organization's normal
DNS server.

The analyst checks DHCP information and discovers that the affected
clients received their configuration from an unexpected DHCP server.

This is an example of why DHCP and DNS should be considered together
when investigating network anomalies.

31. DHCP and Network Segmentation

Large organizations often divide networks into logical segments.
Each segment may have different DHCP configuration.

For example:

VLAN 10
Employees
192.168.10.0/24

VLAN 20
Students
192.168.20.0/24

VLAN 30
Guest Devices
192.168.30.0/24

Separate DHCP scopes can be used for the different network segments.

This can make administration easier and can support security policies
designed around network segmentation.

32. DHCP Relay

DHCP uses broadcast communication during parts of the initial
client-server process. Routers normally do not forward ordinary
broadcasts between network segments.

A DHCP relay can help clients communicate with a
DHCP server located on another network segment.

Client VLAN
     |
     v
DHCP Relay
     |
     v
Router / Layer 3 Device
     |
     v
DHCP Server

This allows centralized DHCP services to support multiple network
segments.

33. DHCP Security Review

From a cybersecurity perspective, remember these relationships:

DHCP
 |
 +-- IP Assignment
 |
 +-- Gateway Configuration
 |
 +-- DNS Configuration
 |
 +-- Lease Information
 |
 +-- Network Identity Evidence
 |
 +-- Security Monitoring

A compromise or misconfiguration of DHCP can therefore affect several
other parts of network communication.

34. Review Questions

1. What does DHCP stand for?
2. Why is DHCP used?
3. What is a DHCP client?
4. What is a DHCP server?
5. What does DORA stand for?
6. What happens during DHCP Discover?
7. What is a DHCP Offer?
8. What is a DHCP Request?
9. What is a DHCP ACK?
10. What is a DHCP lease?
11. What is a DHCP scope?
12. What is a DHCP reservation?
13. How does DHCP work with DNS?
14. What is a rogue DHCP server?
15. What is DHCP starvation?
16. What is DHCP snooping?
17. Why can DHCP logs be useful during a security investigation?
18. What information can ipconfig /all display?
19. What is a DHCP relay?
20. Why should DHCP infrastructure be protected?

35. Key Takeaways

• DHCP automatically provides network configuration to clients.
• DORA represents Discover, Offer, Request and Acknowledgement.
• DHCP leases control how long assigned addresses can normally be used.
• DHCP scopes define address pools available to clients.
• DHCP can provide IP addresses, gateways and DNS server information.
• DHCP and DNS work together but perform different functions.
• Rogue DHCP servers can provide unauthorized network configuration.
• DHCP starvation can exhaust available addresses.
• DHCP snooping can help defend against unauthorized DHCP servers.
• DHCP records can help connect IP addresses with devices and timestamps.
• DHCP relay can support centralized DHCP across multiple network segments.
• Proper DHCP security is an important part of network defense.

36. Lesson Summary

DHCP is a fundamental network service that simplifies the configuration
of computers and other network devices. It provides information such
as IP addresses, subnet masks, gateways and DNS servers.

For cybersecurity professionals, DHCP is also an important source of
network evidence. DHCP records can help determine which device used
an IP address at a particular time, while DHCP security controls can
help prevent unauthorized configuration and network attacks.

Understanding DHCP gives students a stronger foundation for network
troubleshooting, security monitoring, incident response and network
defense.