lesson 4.1 · chapter 4 of 5: getting an address · 30 min
DHCP, step by step
objective
Follow a laptop from plugged in, no address to 192.168.1.10, frame by frame: the four DHCP messages, which ones are shouted to everyone and which go to just one host, and the MAC and IP addresses inside each.
How does a new laptop get an address?
The new student
It’s a new student’s first day. They don’t know anyone or where to sit. So they stand at the front and ask the whole room, “Where can I sit?” The teacher walks over and says, just to them, “Desk 10 is free.” The student says, out loud to everyone, “I’ll take desk 10!” And the teacher says, just to them, “It’s yours, for this term.”
A brand-new laptop plugged into a network is that new student. It has a MAC address (its name, lesson 1.1) but no IP address (where it lives, lesson 3.1), so it can’t talk to anything beyond the end of its cable.
in one sentence A new laptop is like a new student: it has a name, but no seat yet.
DHCP: the teacher who hands out seats
Nobody wants to type addresses by hand into every phone and laptop. So one computer on the network has the job of handing them out: the DHCP server. DHCP stands for Dynamic Host Configuration Protocol. Taking it apart:
- Dynamic: automatic, done as needed.
- Host: a laptop, phone or anything else that sends its own messages (lesson 1.1).
- Configuration: its settings.
- Protocol: the agreed rules (lesson 1.2).
So: the rules for giving hosts their settings automatically. At home, the DHCP server is inside your home router. At school or in an office, it’s often a server in a data center (lesson 2.3).
in one sentence A DHCP server hands out addresses and settings to new hosts automatically.
Shouting and whispering
There are two ways to send a message, and DHCP uses both:
- Broadcast: to everyone on the network, like the student asking the whole room. In a frame, the
broadcast MAC address is
FF:FF:FF:FF:FF:FF, and the broadcast IP address is255.255.255.255. Both mean all of you. - Unicast: to one host only, like the teacher talking to just the student. It uses that host’s own address. (Uni means one, like a unicycle has one wheel.)
in one sentence A broadcast goes to everyone on the network; a unicast goes to just one host.
DORA: four messages
The laptop and the DHCP server swap four messages, and their first letters spell DORA:
| Message | Sent by | In plain words | Who gets it | |
|---|---|---|---|---|
| D | Discover | laptop | Is there a DHCP server out there? | everyone: a broadcast |
| O | Offer | server | You can have 192.168.1.10 | just the laptop: a unicast |
| R | Request | laptop | Yes please, I’ll take 192.168.1.10 | everyone: a broadcast |
| A | Ack | server | It’s yours for 24 hours | just the laptop: a unicast |
Ack is short for acknowledge: to say yes, got it.
in one sentence Discover (shout), Offer (to you), Request (shout), Ack (to you): DORA.
What the laptop gets
It doesn’t just get an address. It gets four settings:
- its IP address, like
192.168.1.10; - the subnet mask, which says which addresses are on its own network (lesson 3.2);
- the default gateway: the router, the way out to other networks (lesson 2.1);
- a DNS server. DNS stands for Domain Name System: the internet’s phone book. People use names like
networkdoodles.com, but computers need IP addresses, so the DNS server looks names up and gives back the address.
It gets them for a while, not forever, like borrowing a library book. That loan is called the lease. Halfway through, the laptop asks to keep its address for longer, and usually the answer is yes.
in one sentence The laptop borrows an address, a mask, a gateway and a DNS server, for the length of a lease.
The network we’ll watch
A small home network: your laptop, a printer and the home router, all plugged into one switch (from lesson 2.1). Each one has a MAC address, burned into its network card. We’ve made them easy to spot:
| Host | MAC address | IP address |
|---|---|---|
| Your laptop | AA:AA:AA:11:11:11 | none yet |
| Printer | BB:BB:BB:22:22:22 | 192.168.1.5 |
| Home router, the DHCP server | CC:CC:CC:33:33:33 | 192.168.1.1 |
DHCP messages travel inside the layers from lesson 1.2, like every other message. Under the animation, the inside the frame box opens each one up:
- L1, physical: the signal on the cable, ones and zeros.
- L2, data link: the Ethernet frame, with a destination MAC and a source MAC. The switch reads this.
- L3, network: the IP packet, with a destination and source IP address.
- L4, transport: UDP (User Datagram Protocol: a quick way to send a message without checking first that the other side is ready, like dropping a postcard in a postbox), with port numbers. A port number says which program a message is for: DHCP servers listen on port 67, and the computer asking for an address (the client, meaning the one asking for a service) listens on port 68.
- L7, application: the DHCP message itself: Discover, Offer, Request or Ack, and the settings.
Next to it is the switch’s MAC address table: which MAC address lives on which port. It starts empty and fills up as the switch sees frames.
in one sentence Three hosts on one switch, each with its own MAC address, and a frame you can open layer by layer.
Watch the laptop get its address
Press Play, or step through with → (the arrow keys work too). Turn on Slow for the busy steps. In each step, look at the highlighted parts of the frame: they’re what changes.
What to notice, step by step:
- Plugged in: layer 1 comes up first. No cable (or no Wi-Fi), no network.
- Discover: the destination MAC is
FF:FF:FF:FF:FF:FFand the source IP is0.0.0.0. Both say I don’t know anyone and I’m nobody yet. - The switch learns, then floods: it learns from the source MAC and decides where to send from the destination MAC. A broadcast goes everywhere; the printer opens it and throws it away.
- The server picks an address from its pool.
- Offer: now it’s a unicast to
AA:AA:AA:11:11:11, and the switch, which learned that address in step 3, sends it to port 1 only. - Request: broadcast again. Same shape as the Discover, with the address it wants inside.
- Ack: unicast again.
- Configured: four settings, and a lease.
Wi-Fi works the same way. A phone joining Wi-Fi does exactly these four steps; the “cable” is radio instead of copper, and the access point does the switch’s job.
Try it on your own computer (optional)
You can see the result of DORA on your own laptop: the address, the DHCP server it came from, and the lease.
On Windows, open Command Prompt (press the Windows key, type cmd, press Enter) and type:
ipconfig /all
Find your Wi-Fi or Ethernet adapter. Look for Physical Address (your MAC), IPv4 Address, DHCP Server,
Lease Obtained and Lease Expires. To watch it happen again, ipconfig /release gives the address back
and ipconfig /renew runs DORA for a new one (your internet drops for a few seconds in between).
On a Mac, open Terminal (press Cmd+Space, type terminal, press Enter) and type:
ipconfig getpacket en0
That prints the last DHCP Ack your Mac got on Wi-Fi (en0 is usually Wi-Fi; try en1 if it’s empty).
Look for yiaddr (your IP address), chaddr (your MAC), subnet_mask, router, domain_name_server and
lease_time (in seconds). You just read the inside of a real Ack.
in one sentence The laptop shouts twice and the server whispers twice, and at the end the laptop has its address.
A second laptop joins
Your friend plugs their laptop into port 4 of the same switch. Its MAC address is DD:DD:DD:44:44:44,
and the router offers it 192.168.1.11. The switch still has its table from the animation.
Work out, for your friend’s Discover and the router’s Offer back to them:
- the destination MAC and source MAC;
- the destination IP and source IP;
- which ports the switch sends each one out of, and so whether your laptop sees it;
- what the switch’s MAC address table looks like after both.
hint
Every Discover and Request looks the same from the outside: the shout to everyone. Only the source MAC changes.
hint
The switch learns from the source MAC of every frame it receives. So after the Discover it knows port 4. Broadcasts go out of every port except the one they came in on.
hint
For the Offer, the switch looks up the destination MAC in its table. It learned DD:DD:DD:44:44:44 a moment ago.
show the solution
| Discover | Offer | |
|---|---|---|
| dst MAC | FF:FF:FF:FF:FF:FF (broadcast) | DD:DD:DD:44:44:44 (unicast) |
| src MAC | DD:DD:DD:44:44:44 | CC:CC:CC:33:33:33 |
| dst IP | 255.255.255.255 | 192.168.1.11 |
| src IP | 0.0.0.0 | 192.168.1.1 |
| out of ports | 1, 2 and 3 (everything except 4) | 4 only |
| your laptop sees it? | yes, and ignores it (it’s not a DHCP server) | no |
The switch’s table after both:
| port | MAC address |
|---|---|
| 1 | AA:AA:AA:11:11:11 |
| 3 | CC:CC:CC:33:33:33 |
| 4 | DD:DD:DD:44:44:44 |
The printer still isn’t in it: it hasn’t sent anything yet, and the switch only learns from frames it receives.
5 check: test yourself
Pick an answer for each question. You'll see straight away whether it's right, and why. Questions marked what happens next? are about the animations.
what happens next?The laptop sends its DHCP Discover. Who receives it?
It’s a broadcast to
FF:FF:FF:FF:FF:FF, so the switch sends it everywhere. The printer gets a copy too, and ignores it.What source IP address does the Discover use?
0.0.0.0means I don’t have an address yet.255.255.255.255is where it’s going: everyone.what happens next?The router sends back its Offer. The switch already knows the laptop is on port 1. What happens next?
The Offer is a unicast to the laptop’s MAC address, and the switch knows where that is. That’s the whole difference between a shout and a whisper.
What do the four letters D-O-R-A stand for, in order?
Discover (anyone there?), Offer (here’s an address), Request (yes please, that one), Ack (it’s yours).
Why is the Request a broadcast, even though the laptop now knows who the server is?
It isn’t officially using the address yet, and every server that made an offer needs to hear the answer, so the others can give theirs to someone else.