DHCP & IPAM: The Engineering of Address Automation

The Bootstrap Problem

Every device entering a network is born with only two things: its hardware MAC address and its desire to talk. To participate in an IP-based internet, it needs a logical identity (IP Address), a gateway to the world (Default Gateway), and a phonebook to find its peers (DNS Servers).

1. The 4-Step Handshake (DORA)

DHCP doesn't just "hand out" addresses. It follows a strictly choreographed dialogue known by the acronym DORA:

Discover (Broadcast)

The client sends a broadcast packet out with source IP 0.0.0.0 and destination 255.255.255.255. It is effectively shouting "I am here, and I need a configuration!"

Offer (Unicast/Broadcast)

Any DHCP server that hears the shout checks its database. If it has a free IP in that subnet, it "offers" it to the client. Crucial: It reserves the IP so it doesn't offer it to someone else simultaneously.

Request (Broadcast)

The client broadcasts its acceptance of a specific server's offer. This is broadcasted so other servers know their offers were rejected and they can release their reserved IPs.

Acknowledge (Unicast/Broadcast)

The server sends the final ACK, containing the Lease Time, Gateway, and Subnet Mask. The client is now officially "on the network."

2. Leases, T1, and T2 Timers

DHCP IPs are not "owned"; they are **leased**.

• T1 Timer (50%): At halfway through the lease, the client attempts to renew the IP with the *original* server via Unicast.
• T2 Timer (87.5%): If the original server is gone, the client broadcasts to *any* available server at the 87.5% mark.

If the lease completely expires, the client must drop the IP and start the DORA cycle from scratch.

3. Security: The Rouge DHCP Threat

Like ARP, DHCP is trust-based. If an attacker plugs in a router and starts responding to "Discover" packets faster than the corporate server, they can tell clients their gateway is the attacker's laptop.

This is mitigated by **DHCP Snooping** on enterprise switches. This feature differentiates between "trusted ports" (where the real server lives) and "untrusted ports" (where users live), dropping any DHCP server messages arriving on untrusted ports.

Conclusion

DHCP is far more than a "plug and play" luxury. It is a critical state machine that manages the most precious resource in the network: the logical address space. By mastering the details of DORA, Relay behavior, and Snooping, engineers can build resilient, self-healing networks that scale effortlessly across thousands of segments.