Part 4 — Getting connected automatically

Two protocols do all the work you never think about: one gives your device an address, the other turns names into addresses.

Chapter 17 — DHCP: how your device gets an address

In one sentence

When you join a network, your device shouts "does anyone here hand out addresses?", and a DHCP server replies with an address, a gateway, and DNS servers — a lease that expires and gets renewed.

The problem

Someone has to assign your laptop an IP address, tell it the subnet mask, tell it which router to use, and tell it where to look up names. Doing this by hand for every device in an office (or a coffee shop) is impossible.

The idea, in plain language

   YOU (new to the network, shouting to everyone):
       "Hello? Does anyone give out addresses?"

   DHCP SERVER (your router):
       "Yes! You can have 192.168.1.50."

   YOU (shouting again, so other servers know you've chosen):
       "Great, I'll take 192.168.1.50 from you."

   DHCP SERVER:
       "Confirmed. It's yours for 24 hours. Here's everything else you need:
        your mask is /24, your gateway is 192.168.1.1, your DNS is 192.168.1.1."

Four messages. This is called DORA, from the message names.

How it actually works: DORA

   Client                                            Server
   (has NO address yet, so it uses 0.0.0.0
    and shouts to 255.255.255.255)

     |--- 1. DISCOVER  (broadcast) ------------------->|
     |    "Anyone out there? My MAC is aa:bb:cc:.."    |
     |                                                 |
     |<-- 2. OFFER  ---------------------------------- |
     |    "Have 192.168.1.50, mask /24, gw .1,         |
     |     DNS .1, lease 86400 seconds"                |
     |                                                 |
     |--- 3. REQUEST  (broadcast) -------------------->|
     |    "I accept 192.168.1.50, from YOU specifically"|
     |    (broadcast so any other DHCP servers know    |
     |     to withdraw their offers)                   |
     |                                                 |
     |<-- 4. ACK  ------------------------------------ |
     |    "Confirmed. It's yours."                     |

DHCP runs over UDP, ports 67 (server) and 68 (client). The first two messages are broadcasts because the client doesn't have an address yet — the chicken-and-egg problem solved by shouting.

The lease: why your address changes

You don't own the address; you lease it.

   0%                    50% (T1)          87.5% (T2)         100%
   |----------------------|-----------------|-----------------|
   lease starts       RENEW: quietly    REBIND: ask ANY     lease expires:
   (e.g. 24 hours)    ask the same      server, by          you MUST stop
                      server for more   broadcast           using the address
                      time

Normally you renew at 50% and never notice. If your router reboots or you move networks, the process starts over.

The instant diagnosis: `169.254.x.x`

If nothing answers the DISCOVER, your device gives up and assigns itself an address from 169.254.0.0/16 (called APIPA or link-local). Windows shows "limited connectivity"; macOS shows "self-assigned IP".

Seeing 169.254.something means: DHCP failed. Either there's no DHCP server reachable, the cable/Wi-Fi isn't really connected, the DHCP pool is exhausted, or something is blocking broadcasts. This is one of the highest-value diagnostic facts in networking.

What else DHCP gives you

Beyond the address, the server sends options:

Option	What it is
1	Subnet mask
3	Default gateway (your router)
6	DNS servers
51	Lease time
15 / 119	Domain name / search list
42	NTP (time) servers

So one exchange configures nearly everything.

Things that go wrong

Rogue DHCP server. Someone plugs a home router into the office network and it starts handing out addresses. Devices get the wrong gateway and lose connectivity, or worse, route through the attacker. Enterprise switches prevent this with DHCP snooping (only trusted ports may send OFFERs).
Pool exhaustion. A conference with 500 devices and a 100-address pool and a 7-day lease: after the first day, nobody new can connect. Symptom: new devices get APIPA. Fix: bigger pool or shorter lease.
Duplicate address. Two devices, same address (usually one statically configured inside the DHCP range). Intermittent, maddening connectivity.

Practice (25 min)

A. Watch DORA happen live. This is very satisfying.

# Terminal 1 -- start capturing
sudo tcpdump -i any -n -v 'udp port 67 or udp port 68'

# Terminal 2 -- force a renewal
# Linux (NetworkManager):
sudo nmcli device reapply <your-interface>
#   or, more forcefully:
sudo dhclient -r && sudo dhclient
# macOS:
sudo ipconfig set en0 DHCP

You'll see the DISCOVER / OFFER / REQUEST / ACK sequence, with all the options listed. Save a copy in notes.md.

B. Look at your current lease:

# Linux
nmcli -f DHCP4 connection show "<connection name>"
cat /var/lib/dhcp/dhclient.leases 2>/dev/null | tail -30

# macOS
ipconfig getpacket en0

Find: your address, lease time, gateway, DNS servers.

C. Log into your router's admin page (usually http://192.168.1.1) and find the DHCP settings. Look at:

The address pool range
The lease time
The list of currently connected devices

Try setting a reservation for one device (bind its MAC to a fixed address) — this is how you give a printer or server a stable address without configuring it manually.

Common confusions

"Static IP vs DHCP reservation?" A static IP is configured on the device (and the DHCP server doesn't know about it — risk of conflict). A reservation is configured on the server (device still uses DHCP, always gets the same address). Reservations are almost always the better choice.
"Why is DHCP UDP and not TCP?" You can't do a TCP handshake without an address. UDP broadcast is the only option available.
"Does DHCP work across routers?" Broadcasts don't cross routers, so a DHCP relay on the router forwards them to a central server. That's how one server can serve a whole company.

Check yourself

What are the four DHCP messages, in order?
Why are the first messages broadcast?
What does a 169.254.x.x address tell you?
Name three things besides an IP address that DHCP provides.