October 31, 2026 · CertCrack Blog

How DHCP Works: How Your Device Gets an IP Address Automatically

Plug a laptop into a network, join a Wi-Fi network, or boot a virtual machine, and within seconds it has an IP address, a subnet mask, a default gateway, and DNS server addresses — without anyone typing them in. That automatic setup is the Dynamic Host Configuration Protocol, or DHCP. It is one of those topics that sounds boring until you understand it, and then you start seeing it everywhere: in every help-desk ticket about "no internet," in every Network+ and CCNA question about address assignment, and in every office network that would be unmanageable without it.

Why addresses are not typed in by hand anymore

In the early days of networking, every device got its IP address typed in manually. That works for five computers. It does not work for five hundred, or for a building full of phones and laptops that come and go all day. Manual addresses cause mistakes: two devices given the same address, a mistyped subnet mask, a forgotten gateway, a device that keeps an old address after it moves to a different network.

DHCP solves this by handing addresses out from a central pool and taking them back when they are no longer needed. A DHCP server — often built into a home router, a Windows Server, or a network appliance — owns a range of addresses called a scope. When a device joins the network, it asks for an address; when it leaves, the address goes back into the pool for someone else. Nothing is permanent, and nothing has to be typed in.

DORA: the four-step conversation

DHCP runs over UDP, with the server listening on port 67 and the client on port 68. A device that has just joined a network has no address yet, so it cannot send a normal addressed message. Instead, it shouts to the whole local network using a broadcast. The exchange has four steps, and exam questions love the acronym DORA:

1. Discover. The client broadcasts a DHCPDISCOVER message from source address 0.0.0.0 to the broadcast address 255.255.255.255, effectively asking, "Is there a DHCP server out there?" Because it has no address yet, every device on the local network hears it, but only DHCP servers answer.
2. Offer. Each DHCP server that hears the discover replies with a DHCPOFFER: "I can give you this address, with this subnet mask, and — carried as options inside the offer — this gateway and these DNS servers, for this long." If more than one server replies, the client normally takes the first offer it receives.
3. Request. The client broadcasts a DHCPREQUEST saying, "I accept that offer." It broadcasts rather than replying directly so that any other servers that offered know their offer was not taken and can put that address back in their pool.
4. Acknowledge. The chosen server sends a DHCPACK, confirming the deal. Only now does the client actually configure its network interface with the offered address and settings.

That is the whole conversation, and it usually finishes in well under a second. A useful way to remember it: Discover, Offer, Request, Acknowledge — DORA.

Leases: addresses are borrowed, not owned

A DHCP address comes with a lease time — a period after which the client must check in again. Home routers often use a day; office networks may use a week or longer. The lease is what makes the pool reusable: a visitor's laptop that leaves on Friday does not hold its address forever.

Renewal happens automatically, on a schedule every client follows. When half the lease time has passed, the client tries to renew directly with the server that gave it the address. If that server does not answer — say it is down, or the device has moved — the client tries again at 87.5% of the lease, this time broadcasting to any DHCP server on the network. If no server answers by the time the lease expires, the client must give the address up and start the whole DORA process again. You never have to do any of this yourself; it is why a laptop that has been asleep all weekend still "just works" on Monday morning.

What else DHCP hands out

An IP address alone is not enough to get online. Along with the address, the server sends a set of options, and the important ones are worth memorising:

• Subnet mask — which part of the address is the network and which part is the host.
• Default gateway — the router address the device sends traffic to when the destination is not on the local network.
• DNS server addresses — so the device can turn names like certcrack.com into IP addresses (see our article on how DNS works).
• Lease duration — how long the client may keep the address before renewing.
• Domain name — the local domain suffix the device belongs to, if any.

A network administrator can also configure two special cases inside a scope. An exclusion range reserves part of the pool so DHCP never hands those addresses out — useful for printers, servers, and routers that need fixed addresses. A reservation ties one specific address to one device's MAC address, so that device always gets the same address from DHCP. A reservation looks like a static address to the device using it, but it is still managed centrally, which is the point.

One catch: broadcasts do not cross routers

A broadcast reaches every device on the local network segment — and stops there, because routers do not forward broadcasts. So what happens on a large network where the DHCP server sits on a different subnet from the clients? That is where a DHCP relay agent comes in. A router (or a switch) configured as a relay agent catches the client's broadcast, wraps it into a normal unicast message, and forwards it to the DHCP server's address. On Cisco equipment this is configured with the ip helper-address command on the interface facing the clients. Exam questions that mention a client on one subnet and a server on another are almost always testing whether you know a relay agent is needed.

When DHCP fails: the 169.254 clue

If a Windows device cannot reach a DHCP server, it does not simply sit there with no address. It assigns itself an address from the link-local range 169.254.0.0/16 — a process called Automatic Private IP Addressing, or APIPA. An APIPA address lets devices on the same local segment talk to each other, but it has no gateway and no DNS, so there is no internet access.

For a technician, a 169.254 address is a diagnostic gift: it tells you immediately that DHCP failed, and your job becomes finding out why. The checklist is short: is the device actually connected (cable, Wi-Fi, switch port)? Is the DHCP server running, and does its scope still have free addresses? Is a relay agent configured if the server is on another subnet? Is the client getting an address at all, or is something blocking the broadcast? On Windows, ipconfig /all shows whether DHCP is enabled and what address was assigned, and ipconfig /release followed by ipconfig /renew forces a fresh DORA exchange — the first thing to try before assuming the hardware is broken.

The security side: rogue servers

DHCP trusts whoever answers first, and that trust can be abused. A rogue DHCP server — a device plugged into the network by an attacker, or even by a well-meaning employee who connected a home router — can hand out wrong gateway and DNS addresses, quietly redirecting traffic through an attacker-controlled machine. A related attack, DHCP starvation, floods the server with fake requests until its pool is empty and legitimate clients get nothing.

The main defence on modern switches is DHCP snooping: the switch learns which ports are allowed to send DHCP server messages (trusted ports, facing the real server) and drops server messages arriving on any other port. It can also rate-limit DHCP requests to blunt a starvation attack. Security+ questions pair rogue DHCP servers with DHCP snooping for exactly this reason.

Exam connection

DHCP appears across the certifications this site covers. CompTIA A+ Core 1 (220-1201) tests the DORA process, the 169.254 APIPA range, and the ipconfig /release and /renew commands. Network+ (N10-009) goes deeper into scopes, reservations, exclusions, relay agents, and lease renewal timing. CCNA (200-301) expects you to configure a DHCP server and a relay agent on Cisco equipment, and to troubleshoot address assignment. Security+ (SY0-701) approaches it from the threat side: rogue servers, starvation, and DHCP snooping as the mitigation. Learn DORA, the two ports, the two renewal points, and the APIPA range, and you have the core of nearly every DHCP question on these exams.

Practical takeaway

Think of DHCP as a lending library for IP addresses: a device asks, a server offers, the device accepts, the server confirms — and the loan comes with a return date. When a device cannot get online, check whether it actually borrowed an address at all: a 169.254 address means the loan never happened, and the fault is in the connection, the server, the scope, or the relay between them. That one check turns a vague "no internet" ticket into a short, specific list of things to test.

FAQ

What is the difference between a DHCP reservation and a static IP address?

A static address is typed directly into the device and never changes unless someone edits it. A reservation is still handed out by the DHCP server, but always the same address, tied to the device's MAC address. Reservations are easier to manage centrally: change the reservation on the server and every device's assignment can be updated from one place.

Why does my device sometimes get a different IP address after a reboot?

Because DHCP addresses are leased, not owned. If your lease expired while the device was off, or the pool gave your old address to someone else, the server hands you the next free address when you ask again. A reservation is the fix if a device genuinely needs the same address every time.

Do I need DHCP on a home network?

Almost certainly you already have it: your home router runs a DHCP server by default, which is why phones and laptops connect without any setup. Turning it off would mean typing an address, mask, gateway, and DNS servers into every device by hand — and fixing the duplicates that follow.