DHCP Explained: How Your Device Gets Its Address

Open a command promptIn plain words: A window where you type instructions instead of clicking. The shortcut name is cmd.Technical: Windows’ text-mode shell (cmd.exe). PowerShell is a newer one. On a Mac the equivalent is Terminal.Click for the full glossary entry and type:

> ipconfig /all

The output is long. Find the section for the connection you are using (Wi-Fi or Ethernet) and read these lines:

• DHCPIn plain words: The front desk of your network. When a phone or laptop joins, DHCP hands it an address, like a hotel handing you a room key, so nobody types it in by hand.Technical: Dynamic Host Configuration Protocol. A service, normally on your router, that leases each device an IP address, subnet mask, gateway and DNS server automatically.Click for the full glossary entry Enabled: Yes — your address came from DHCP rather than being typed in.
• IPv4 AddressIn plain words: A device’s street address on a network: four numbers separated by dots, like 192.168.1.37.Technical: A 32-bit number (IPv4), written as four octets. It combines which network the device is on and which device it is on that network.Click for the full glossary entry and Subnet MaskIn plain words: A number that tells a device which part of an address is the street (the network) and which part is the house number (the device).Technical: A 32-bit pattern of ones then zeros, written like 255.255.255.0. Ones mark the network part, zeros the device part.Click for the full glossary entry — what you were given.
• Default GatewayIn plain words: The door out of your network. It is your router.Technical: The router address your device sends traffic to when the destination is not on its own subnet. At home, often 192.168.1.1.Click for the full glossary entry — your routerIn plain words: The box that connects your home to the internet and passes data between networks.Technical: Forwards packets between networks. At home it is usually also the Wi-Fi access point and the DHCP server.Click for the full glossary entry.
• DHCP Server — who gave you the address. At home this is usually your router, such as 192.168.1.1.
• DNSIn plain words: The internet’s phone book. You type an easy name like stashgrid.ai, and DNS looks up the number address that computers really use, the way a street address tells the mail carrier where to go.Technical: Domain Name System. A worldwide set of servers that turns names into IP addresses. Your device asks a DNS server (usually your router or your provider) every time you visit a site.Click for the full glossary entry Servers — where your computer asks “what number is this name?”
• LeaseIn plain words: An address that is lent to you for a while, like a library book you have to renew.Technical: The time a DHCP server lets a device keep an address before it must renew. Home routers often use hours to a day.Click for the full glossary entry Obtained and Lease Expires — when you got it and when you must renew.

Why this matters. Five things you never typed in, all delivered by one conversation. This is the screen a technician checks first when a device cannot get online.

When a device joins the network it has no address, so it has to shout to everyone. The conversation always goes in the same four steps, which spell DORAIn plain words: The four-step chat a device has to get an address: it asks, an offer comes back, it says yes, and the server confirms.Technical: Discover, Offer, Request, Acknowledge: the four DHCP messages, sent over UDP ports 68 (device) and 67 (server).Click for the full glossary entry:

• D — Discover. The device broadcasts: “Is there a DHCPIn plain words: The front desk of your network. When a phone or laptop joins, DHCP hands it an address, like a hotel handing you a room key, so nobody types it in by hand.Technical: Dynamic Host Configuration Protocol. A service, normally on your router, that leases each device an IP address, subnet mask, gateway and DNS server automatically.Click for the full glossary entry server out there? I need an address.”
• O — Offer. A DHCP server answers: “Here, you can have 192.168.1.37.”
• R — Request. The device replies: “Yes please, I will take 192.168.1.37.” (It asks formally in case more than one server made an offer.)
• A — Acknowledge. The server confirms: “It is yours for the next so many hours.”

This happens over two fixed doors called ports: devices listen on UDP port 68 and servers on UDP port 67. You do not need to remember the numbers for daily use, but the exam likes them.

Why this matters. If you know the four steps, you can tell exactly where a failure happens. “Discover goes out, no Offer comes back” means no DHCP server is answering.

The address is lent, not given. When half the leaseIn plain words: An address that is lent to you for a while, like a library book you have to renew.Technical: The time a DHCP server lets a device keep an address before it must renew. Home routers often use hours to a day.Click for the full glossary entry is used up, your device quietly asks to renew it, and the server almost always says yes. If a device leaves the network and the lease runs out, the address goes back in the pool for someone else.

• Dynamic — the normal case. Addresses come from a pool and may change.
• Reservation — you tell the routerIn plain words: The box that connects your home to the internet and passes data between networks.Technical: Forwards packets between networks. At home it is usually also the Wi-Fi access point and the DHCP server.Click for the full glossary entry “always give this device this address.” The device still uses DHCPIn plain words: The front desk of your network. When a phone or laptop joins, DHCP hands it an address, like a hotel handing you a room key, so nobody types it in by hand.Technical: Dynamic Host Configuration Protocol. A service, normally on your router, that leases each device an IP address, subnet mask, gateway and DNS server automatically.Click for the full glossary entry, but gets the same address every time. Good for printers and servers.
• Static — you type the address into the device yourself, and DHCP is not involved. Fine for network gear, risky if two devices end up with the same one.

Why this matters. “The printer stopped working” is very often “its address changed.” A reservation fixes that for good.

You can ask for a fresh address on purpose. Your connection will drop for a few seconds. Do this one at a time, not in the middle of a call or on a work computer.

> ipconfig /release

Your address disappears (it becomes 0.0.0.0 and the internet stops). Then:

> ipconfig /renew

After a few seconds you get an address back, usually the same one. Run ipconfig /all again and compare LeaseIn plain words: An address that is lent to you for a while, like a library book you have to renew.Technical: The time a DHCP server lets a device keep an address before it must renew. Home routers often use hours to a day.Click for the full glossary entry Obtained: it has a new time.

Why this matters. This is the classic first fix for “connected, but no internet.” It forces the whole DORAIn plain words: The four-step chat a device has to get an address: it asks, an offer comes back, it says yes, and the server confirms.Technical: Discover, Offer, Request, Acknowledge: the four DHCP messages, sent over UDP ports 68 (device) and 67 (server).Click for the full glossary entry conversation to happen again.

Open WiresharkIn plain words: A free tool that lets you watch the actual messages travelling over your network, like a window onto the mail room.Technical: A packet analyser that captures traffic on an interface and decodes it by protocol.Click for the full glossary entry and start a capture on the connection you are using (Lab 12 shows how). In the filter bar type dhcp and press Enter. (On older Wireshark versions the filter is bootp.)

Now go back to the command promptIn plain words: A window where you type instructions instead of clicking. The shortcut name is cmd.Technical: Windows’ text-mode shell (cmd.exe). PowerShell is a newer one. On a Mac the equivalent is Terminal.Click for the full glossary entry, run ipconfig /release, then ipconfig /renew. Return to Wireshark.

You should see up to four lines, named DHCPIn plain words: The front desk of your network. When a phone or laptop joins, DHCP hands it an address, like a hotel handing you a room key, so nobody types it in by hand.Technical: Dynamic Host Configuration Protocol. A service, normally on your router, that leases each device an IP address, subnet mask, gateway and DNS server automatically.Click for the full glossary entry Discover, DHCP Offer, DHCP Request and DHCP ACK. Click each one and expand Dynamic Host Configuration Protocol to see the address being offered and the leaseIn plain words: An address that is lent to you for a while, like a library book you have to renew.Technical: The time a DHCP server lets a device keep an address before it must renew. Home routers often use hours to a day.Click for the full glossary entry time. Depending on your routerIn plain words: The box that connects your home to the internet and passes data between networks.Technical: Forwards packets between networks. At home it is usually also the Wi-Fi access point and the DHCP server.Click for the full glossary entry and adapter you may see only the Request and ACK. If so, say so in your notes rather than assuming it is wrong: capture what your own machine actually does.

Check your own capture rather than assuming. Real networks are messier than diagrams. — Nyx

If Windows asks for an address and gets no answer, it gives itself one that starts with 169.254In plain words: The “I could not get a real address, so I made one up” address. You are connected but cannot get online.Technical: APIPA / link-local address. Windows assigns itself one in 169.254.0.0/16 when DHCP does not answer.Click for the full glossary entry. Run ipconfig: if you see 169.254.x.x, your computer joined the network but DHCPIn plain words: The front desk of your network. When a phone or laptop joins, DHCP hands it an address, like a hotel handing you a room key, so nobody types it in by hand.Technical: Dynamic Host Configuration Protocol. A service, normally on your router, that leases each device an IP address, subnet mask, gateway and DNS server automatically.Click for the full glossary entry did not answer.

• Restart the routerIn plain words: The box that connects your home to the internet and passes data between networks.Technical: Forwards packets between networks. At home it is usually also the Wi-Fi access point and the DHCP server.Click for the full glossary entry (unplug for 30 seconds), then plug back in and wait two minutes.
• Check the cable or reconnect to the Wi-Fi.
• Run ipconfig /renew.
• If many devices have the same problem, the router’s address pool may be full or its DHCP turned off. Log in to the router and check.

The attacker’s view. Because devices believe the first DHCP offer they hear, a fake DHCP server on the network can hand out a wrong gatewayIn plain words: The door out of your network. It is your router.Technical: The router address your device sends traffic to when the destination is not on its own subnet. At home, often 192.168.1.1.Click for the full glossary entry or DNSIn plain words: The internet’s phone book. You type an easy name like stashgrid.ai, and DNS looks up the number address that computers really use, the way a street address tells the mail carrier where to go.Technical: Domain Name System. A worldwide set of servers that turns names into IP addresses. Your device asks a DNS server (usually your router or your provider) every time you visit a site.Click for the full glossary entry, steering traffic through the attacker. This is called a rogue DHCP server.

The defender’s move. Managed switchesIn plain words: A little extra word after a command that changes how it works, like setting the oven to “fan.”Technical: An argument starting with - or / that modifies a command, for example the -d in tracert -d. Each command has its own list.Click for the full glossary entry have a feature called DHCP snooping that only trusts DHCP replies from the ports where the real server lives. It is a Security+ topic.