DHCP
Dynamic Host Configuration ProtocolDHCP is the welcome desk. When a device joins a network it has no address, no gateway, no resolver — DHCP hands it all of that in one short exchange, then leases the address for a fixed time. It is why plugging in or joining Wi-Fi simply works, with nothing to configure by hand.
DHCP gives a joining device its address, gateway and resolver in one exchange — on a lease it must renew.
Open the DHCP lab →
A machine with no address shouts into the whole subnet—and four packets later it has an IP, a gateway, DNS and a lease with an expiry date.
How it works
The client starts with no address at all, so it broadcasts. Halfway through the lease it quietly renews with the same server — no broadcast needed.
What DHCP does, step by step
With no address, the client broadcasts to 255.255.255.255 — any DHCP server on the segment hears it.
Servers offer a free address from the pool; the client picks one and formally requests it.
The ACK brings the address, subnet, gateway, DNS resolvers and a lease time in one packet.
At about half the lease the client renews directly; let it lapse and the address returns to the pool.
In cybersecurity
DHCP begins with unauthenticated discovery on the local network, so whoever answers first sets your gateway and DNS — a powerful position for an attacker on the same segment.
A fake server answers first and hands out its own gateway & DNS — a clean man-in-the-middle.
Switches learn which port the real server is on and drop offers from any other — the core defence.
Flooding requests with spoofed MACs drains the pool so no one else can get an address.
Because DHCP sets the resolver, a bad lease quietly points every lookup at an attacker’s DNS.
Classless static routes in a lease can steer traffic around a VPN — the “TunnelVision” trick.
Authenticating the device before it ever reaches DHCP keeps rogue clients off the segment.