Class notes · Professor Messer, CompTIA A+ 220-1201 Core 1 · Objective 2.4

Quick reference: the short version of this lesson is the DHCP cheat sheet, part of Section 2.

Learning objectives

By the end of these notes you should be able to:

Explain why DHCP was created and what it replaced.
Describe the four-step DORA process, including the exact source/destination addresses and ports at each step.
Explain why DHCP messages are sent as broadcasts.
Describe a DHCP scope, and the difference between a pool and an exclusion.
Explain how a DHCP scope is configured, using a real console as an example.
Explain DHCP reservations, how they’re matched to a device, and why they’re useful.

1. Why DHCP exists

1.1 Before DHCP

Before automatic addressing, every device’s IP configuration — IP address, subnet mask, default gateway, DNS servers and other settings — had to be entered manually. That was manageable with a small number of devices using unchanging static addresses, but becomes impractical with thousands of devices on a modern network.

1.2 DHCP’s origin and purpose

DHCP (Dynamic Host Configuration Protocol) was created in 1997 to let a system administrator automatically assign this configuration across an entire infrastructure. It’s the reason you can open a laptop in a coffee shop and start browsing immediately, with no manual setup at all.

2. The DORA process

The automated exchange that gets a device its IP address is commonly called DORA: __D

__iscover, __O

__ffer, __R

__equest, __A

__cknowledge. It runs every time a device connects to a network and needs an address from a DHCP server.

2.1 The scenario

Two devices join the network: Sam’s laptop and Jack’s laptop, both with no IP address yet. The default behaviour of almost every OS is to request an address via DHCP automatically. This walkthrough follows Sam’s laptop; Jack’s goes through the identical four steps separately.

Network in this example:

DHCP server: 10.10.10.99
Sam’s laptop, once assigned: 10.10.10.42

2.2 Step 1 — Discover

Sam’s laptop doesn’t know where any DHCP server is, so it broadcasts a DHCP Discover message to find out.

Field

Value

Source IP

0.0.0.0 (Sam has no address yet)

Source port

UDP 68

Destination

Broadcast — reaches every device on the local subnet

The switch forwards this broadcast to every device on the local subnet, including the DHCP server.

2.3 Step 2 — Offer

The DHCP server (10.10.10.99) responds with a DHCP Offer, proposing an IP address Sam’s laptop could use.

Field

Value

Source

The DHCP server, 10.10.10.99

Destination

Broadcast, 255.255.255.255 — Sam has no address to send directly to yet

If more than one DHCP server exists on the network, Sam’s laptop could receive multiple offers to choose between.

2.4 Step 3 — Request

Sam’s laptop picks one offer, and broadcasts a Request for that specific address back to the network.

Field

Value

Source IP

0.0.0.0 (still no address)

Source port

UDP 68

Destination

255.255.255.255, UDP 67

Because it’s a broadcast, every device on the subnet receives it, including the DHCP server — and, if there were more than one, every other DHCP server too (so they know their offer wasn’t chosen).

2.5 Step 4 — Acknowledge

The DHCP server sends an Acknowledgment, confirming the address is now locked in for Sam’s device for the duration of the lease — it won’t be handed to anyone else during that time.

Field

Value

Source

The DHCP server, 10.10.10.99

Destination

Broadcast, 255.255.255.255, UDP 68

Once Sam’s laptop receives this acknowledgment, it finally updates its own configuration — Sam’s laptop is now 10.10.10.42.

2.6 The full sequence

Sam’s laptop (no IP yet) DHCP server (10.10.10.99) | | |— 1. DISCOVER (broadcast, src 0.0.0.0) —–>| | | |<– 2. OFFER (broadcast to 255.255.255.255) —| | | |— 3. REQUEST (broadcast, “I’ll take it”) —>| | | |<– 4. ACK (broadcast: it’s yours) ————| | | Sam’s laptop now configured as 10.10.10.42

Exam tip: notice that every message in DORA is a broadcast. Even the server’s replies go to 255.255.255.255, because the requesting device doesn’t have a usable IP address to be addressed directly until the very last step completes.

3. DHCP scope

3.1 What a scope is

How did the server know which address to offer Sam? It had a predefined list of IP addresses and settings already configured — this is the DHCP scope.

A scope typically defines:

Element

Purpose

Available addresses

The full range that could be assigned

Exclusions

Addresses within that range that must never be handed out — e.g. because a switch or router already uses them statically

Subnet mask

Sent to clients along with their address

Lease duration

How long an assigned address is valid before renewal is needed

Other options

DNS server, default gateway, VoIP server addresses, and more

Why exclusions matter: if a static device (like a router) already uses an address inside the scope’s range, and DHCP handed that same address to someone else, you’d get an IP address conflict. Excluding it prevents that.

3.2 Pools

Within a scope are pools — the actual groups of addresses the server draws from when assigning a dynamic address. These are usually large, contiguous ranges, for example:

192.168.1.0/24 192.168.2.0/24 192.168.3.0/24A device connecting from any of those subnets gets an address pulled from the matching pool.

Pools don’t have to be one single unbroken block. You can define different sections within a pool, with exclusions placed in the middle of the range — for instance, reserving a block for statically configured devices while leaving the rest available for dynamic assignment.

3.3 Worked example — a Windows Server scope

On a Windows Server running the DHCP role, viewed in Server Manager:

A scope is configured, for example named 165.245.44.0, covering that subnet.
The administrator adds the full range of available addresses into the address pool for that scope.
The console also lets you view current leases — which addresses are assigned, and to whom.
Reservations (section 4) and any additional scope options are configured in their own sections of the same interface.

4. DHCP reservations

4.1 Why some devices need a fixed address

DHCP is often thought of as handing out any available address at random. But some devices — a file server, a web server, or a router — need to keep the same address every time they start up.

4.2 The alternative to static configuration

You could visit each of those devices and configure a static IP address by hand. But if your addressing scheme ever changes, you’d have to revisit every single device to update it manually.

A DHCP reservation solves this from one place: you configure the fixed assignment on the DHCP server itself, and never have to touch the device directly.

4.3 How a reservation is matched to a device

The DHCP server is told: “this MAC address always receives this IP address.” The device’s MAC address is the unique identifier used to recognise it and hand out the same address every time.

Other names for this: static DHCP assignment, static DHCP, or simply an IP reservation.

4.4 Worked example — reservations on a home router

A router’s DHCP configuration shows:

Setting

Value

Address pool

192.168.1.2 – 192.168.1.254

Reservation 1

Device “Prometheus” → always 192.168.1.6

Reservation 2

Device “Odyssey” → always 192.168.1.9

These two addresses (.6 and .9) sit inside the pool range, but are never handed out dynamically — they’re reserved for those two specific MAC addresses.
Every other device that connects receives whatever address is next available from the rest of the pool.
Every time Prometheus or Odyssey is turned on, it gets its same, predictable address, without anyone touching the device itself.

5. Security perspective

DHCP has no built-in authentication. Any device that can broadcast on the local network can request an address — and, more importantly, any device can pretend to be a DHCP server. A rogue DHCP server can hand out a malicious default gateway or DNS server, silently redirecting traffic. Managed switches defend against this with DHCP snooping, which only trusts DHCP replies from approved ports.
Broadcasts mean everyone on the segment sees DHCP traffic, including the offers and acknowledgments meant for other devices. This is normal — but it’s also why DHCP traffic is easy to observe (and spoof) on a shared local network.
Reservations are a configuration record worth protecting. Access to the DHCP server’s configuration is access to control over which device gets which address — including the ability to quietly reassign a sensitive server’s address to another machine.
Exclusions prevent conflicts, not attacks. They stop the DHCP server from accidentally handing out an address already in static use — they don’t stop a rogue device from manually claiming an address that’s excluded from the pool.
Lease duration is a security and management trade-off. Short leases mean addresses get reclaimed and reused quickly (useful in high-turnover environments like guest Wi-Fi), while longer leases mean less renewal traffic but slower recovery of “lost” addresses when devices disappear.

Summary

Before DHCP, every device’s IP settings were configured by hand — unworkable at modern scale. DHCP (1997) automates this.
DORA: Discover (broadcast, from 0.0.0.0) → Offer (broadcast, from the server) → Request (broadcast, “I’ll take that one”) → Acknowledge (broadcast, locks in the lease). Every step is a broadcast, because the client has no usable address until the process completes.
A scope is the DHCP server’s configuration for a subnet: available addresses, exclusions, subnet mask, lease duration and other options (DNS, gateway, etc.).
Pools are the groups of addresses drawn from for dynamic assignment — usually large contiguous ranges, but they can have exclusions carved out of the middle.
Reservations tie a specific MAC address to a specific IP address, so a server, router or other fixed device always gets the same address — configured once, centrally, on the DHCP server.

Glossary

Term

Definition

DHCP

Dynamic Host Configuration Protocol — automatic IP configuration

DORA

Discover, Offer, Request, Acknowledge — the DHCP process

Broadcast

A message sent to every device on the local subnet

Lease

The period an assigned IP address remains valid

DHCP scope

A DHCP server’s configuration for a subnet: addresses, exclusions and options

Pool

The group of addresses available for dynamic assignment within a scope

Exclusion

An address within a scope’s range that is never dynamically assigned

DHCP reservation

A fixed IP address permanently tied to a specific device’s MAC address

Static DHCP assignment / IP reservation

Other names for a DHCP reservation

MAC address

The unique hardware address used to identify a device for a reservation

DHCP snooping

A switch feature that only trusts DHCP replies from approved ports

Rogue DHCP server

An unauthorised server handing out (potentially malicious) DHCP configuration

Review questions

Why did DHCP become necessary as networks grew?
What year was DHCP created?
What do the letters in DORA stand for?
What source IP address does a device use when sending a DHCP Discover, and why?
Why is the DHCP Offer sent as a broadcast rather than directly to the requesting device?
At which DORA step does the client’s IP address configuration actually get updated?
What is a DHCP scope, and name three things it can define.
Why would an administrator configure an exclusion within a scope?
What’s the difference between a pool and a scope?
Can a pool have exclusions placed in the middle of its range rather than only at the edges?
Why might an administrator use a DHCP reservation instead of a static IP configured on the device itself?
What identifies a device for a DHCP reservation?
In the router example, why don’t Prometheus and Odyssey’s addresses ever get handed to another device?
Why is a rogue DHCP server a security risk?

Answer key

Manually configuring IP settings on every device became impractical once networks grew to thousands of devices.
1997.
Discover, Offer, Request, Acknowledge.
0.0.0.0, because the device doesn’t have an IP address yet.
The client doesn’t yet have a usable IP address to be addressed directly, so the server must broadcast the offer to reach it.
The final step — Acknowledge. The client updates its configuration only once it receives the server’s acknowledgment.
A scope is the DHCP server’s configuration for a subnet. Any three of: available address range, exclusions, subnet mask, lease duration, DNS servers, default gateway, other options.
To prevent handing out an address already used statically by another device (such as a switch or router), which would otherwise cause an IP address conflict.
A scope is the whole configuration for a subnet (including exclusions and options); a pool is specifically the set of addresses available for dynamic assignment within that scope.
Yes — exclusions can sit anywhere within a pool’s range, not just at the start or end.
So that changes to the addressing scheme only need to be made once, on the DHCP server, rather than by visiting every device individually.
Its MAC address.
Those two addresses are configured as reservations tied to Prometheus’s and Odyssey’s specific MAC addresses, so the DHCP server never offers them to any other device.
It can hand out malicious configuration — such as a false default gateway or DNS server — silently redirecting traffic on the network.