DHCP is the silent workhorse of every network — automatically assigning IP addresses to every device that connects, reclaiming them when they leave, and making large-scale network management possible.
Dynamic Host Configuration Protocol (DHCP) is a network protocol that automatically assigns IP addresses and essential configuration parameters to devices the moment they connect to a network.
DHCP stands for Dynamic Host Configuration Protocol. "Dynamic" refers to how IP addresses are assigned automatically and temporarily, rather than being fixed manually. "Host Configuration" refers to the full set of network parameters — not just the IP address — that DHCP provides. "Protocol" refers to the standardized rules governing the exchange between a client and a DHCP server.
When a device joins, it sends out a request; the DHCP server responds within milliseconds with everything that device needs to communicate — no manual intervention, no configuration files, no room for human error. Beyond IP addresses, DHCP also assigns subnet masks, default gateways, and DNS server addresses. It was originally defined in RFC 2131 as an enhancement of the older BOOTP protocol and remains the backbone of IP address management in virtually every modern network.
DHCP makes network management scalable. Without it, every device that joins a network requires manual configuration — slow, error-prone, and unworkable at enterprise scale.
Devices are ready to communicate the moment they connect — no manual setup required.
Addresses are leased temporarily and reclaimed when devices leave — preventing exhaustion.
Users move between floors, offices, or VLANs and DHCP issues new configuration automatically.
These benefits become especially significant as networks grow. The rise of BYOD policies, IoT devices, remote work, and 5G has dramatically increased the number of endpoints organizations must manage. DHCP is the foundational protocol that makes this growth manageable.
When a device connects, it has no IP address and no way to communicate with a specific server. DHCP solves this through a four-step process known as DORA: Discover, Offer, Request, and Acknowledge. The entire exchange typically completes in under a second.
The client broadcasts a DHCPDISCOVER message to 255.255.255.255 to locate any available DHCP server on the local segment. The message includes the client's MAC address.
Any available DHCP server replies with a DHCPOFFER containing a proposed IP address, lease duration, subnet mask, gateway, and DNS servers.
The client broadcasts a DHCPREQUEST accepting one offer, simultaneously notifying other servers that their offers were not selected so they can return those addresses to their pools.
The selected server sends a DHCPACK confirming the lease. The client configures its network interface and begins communicating.
What ports does DHCP use? DHCP uses two UDP ports — the server listens on UDP 67 and the client receives responses on UDP 68. These port numbers are defined in RFC 2131 and have remained unchanged since the protocol was introduced.
Because DHCP discovery messages are broadcast-based, they cannot cross subnet boundaries on their own. A relay agent sits at the network layer and forwards DHCP messages between clients on remote subnets and a centralized DHCP server — allowing a single server to serve a multi-subnet enterprise network.
A reservation maps a specific IP address to a device's MAC address, ensuring that device always receives the same IP while keeping the address within the DHCP management system. Unlike static configuration, reservations are managed centrally, documented, and visible in lease logs.
Working alongside Dynamic DNS (DDNS), DHCP makes BYOD, IoT, and 5G scale manageable. Integrated DDI platforms (DNS, DHCP, and IP address management) provide a single management plane with real-time visibility into every lease, scope, and device on the network.
A DHCP lease is the time-limited assignment of an IP address to a client device. When a lease reaches its halfway point (T1) the client renews with its assigned server; at 87.5% (T2) it broadcasts to any server; if it expires the client restarts DORA.
Uses 32-bit addresses in the familiar dotted-decimal format. Defined in RFC 2131. The dominant protocol for client configuration on most enterprise networks today.
Defined in RFC 8415. Serves the same function for IPv6's 128-bit addresses. Operates in stateful mode (assigning specific addresses) or stateless mode (parameters only, self-assigned via SLAAC). Most enterprises run dual-stack.
DHCP's automatic, trust-based nature makes it a target. Understanding the common threats — and their defenses — is essential for any network administrator.
An unauthorized DHCP server — set up maliciously or accidentally by a misconfigured home router. If it responds faster than the legitimate server, it can route traffic through an attacker-controlled gateway, provide a malicious DNS server, or enable a man-in-the-middle attack.
A starvation attack floods a DHCP server with DISCOVER requests using spoofed MAC addresses until the address pool is exhausted. Legitimate devices can no longer obtain IPs — often followed by standing up a rogue server to serve the now-unresponsive network.
A switch security feature that classifies each port as trusted (legitimate servers and uplinks) or untrusted (end-device ports). Server responses on untrusted ports are dropped and DISCOVER messages are rate-limited — neutralizing both rogue server and starvation attacks.
Running DHCP on a domain controller increases blast radius. Use dedicated DHCP servers.
Configure primary and secondary servers in a failover pair to maintain availability.
Review history regularly — devices cycling through many IPs may signal a starvation attack.
Combine DHCP fingerprinting with NAC policies to enforce device-type rules automatically.
Experience DHCP-driven IP automation with ManageEngine DDI Central.