DHCP Client, Relay and Server · Topic 1 of 5
DHCP Communication Analysis
Learn the DHCP exchange of discover, offer, request and acknowledge, the UDP ports, lease renewal, and how to capture DHCP packets on RouterOS.
- 5 min
- The four messages are Discover, Offer, Request and Acknowledge.
- Discover and Request are broadcasts from the client.
- The server uses UDP port 67 and the client uses UDP port 68.
What it is
DHCP communication is the exchange of messages by which a client gets its network settings from a server.
A new client has no address and does not know where the server is. So the first messages are broadcasts. Once the client has an address, later messages can be unicast.
Knowing this order lets you read a packet capture and find where a failure happens.
How it works
The standard exchange has four messages, and a few more exist for special cases.
The four messages
| Message | Sent by | Sent to | Purpose |
|---|---|---|---|
| Discover | Client | Broadcast | Find any DHCP server |
| Offer | Server | Client | Propose an address and settings |
| Request | Client | Broadcast | Ask for the offered address |
| Acknowledge | Server | Client | Confirm the lease |
The exchange is often called DORA, after the first letters of the four names.
In the Discover the client uses source address 0.0.0.0, because it has no address. The destination is the limited broadcast address 255.255.255.255. The server listens on UDP port 67 and the client on UDP port 68.
The Request is also a broadcast. It names the server whose offer was accepted, so that other servers on the segment know their offers were not chosen and can free the addresses.
Other messages
| Message | Meaning |
|---|---|
| NAK | The server refuses the request, so the client starts again |
| Decline | The client found that the address is already in use |
| Release | The client gives the address back early |
| Inform | A client with its own address asks only for other settings |
Fields and options
Each message has fixed fields and options. The fixed fields include the transaction id, which links a reply to its request, the client hardware address, and the address offered to the client. The giaddr field holds the relay address, and it is zero when no relay is used.
Options carry the settings. The message type is itself an option.
Other options give the subnet mask, router, DNS servers, lease time and the server identifier. The client can also send its host name and a client identifier.
Lease timers
A lease lasts for a set time. The client does not wait until the end.
| Moment | Action |
|---|---|
| Half of the lease | The client sends a unicast Request to the server to renew |
| Most of the lease gone | If renewal failed, the client broadcasts a Request to any server |
| End of lease | The client stops using the address and starts again with Discover |
A client that renews successfully never sends Discover again. If you see Discover broadcasts repeatedly, the client is not getting or keeping a lease.
Capturing the exchange
RouterOS has a built in packet sniffer that can capture DHCP traffic on the router.
/tool sniffer quick port=67,68
/system logging add topics=dhcp action=memory
/ip dhcp-server lease printThe sniffer shows the packets with their addresses and ports. The logging rule records DHCP events in the router log, such as lease assignments. The lease table shows the result on the server.
Reading a capture
Look at the messages in order. If you see Discover but no Offer, the server did not reply. The cause may be a disabled server, an empty pool, a missing network entry, or a firewall rule.
If you see an Offer but no Request, the client did not like the offer, or the path back to the client is blocked.
If you see Request and no Acknowledge, check whether the server sent a NAK. A repeated pattern of Decline suggests a duplicate address on the network.
Behind a relay
When a relay is in use, the relay turns the broadcast into a unicast to the server and fills the giaddr field. The server uses giaddr to choose the matching pool. A capture at the server then shows unicast packets with the relay address, and not the client broadcast.
A firewall on the router can block UDP 67 and 68. Allow them on the interface that serves the clients.
What to remember for the exam
Eight facts cover most questions on this topic.
- The four messages are Discover, Offer, Request and Acknowledge.
- Discover and Request are broadcasts from the client.
- The server uses UDP port 67 and the client uses UDP port 68.
- A client without an address uses source 0.0.0.0.
- NAK refuses a request, Decline reports a duplicate address and Release returns a lease.
- The client starts renewing at half of the lease time.
- The giaddr field holds the relay address and selects the pool.
/tool sniffer quick port=67,68captures DHCP traffic on the router.
Common mistakes
These four mistakes appear often.
Expecting an Offer to be the final step. The client must still send a Request, and the server must acknowledge it.
Forgetting that the first messages are broadcasts. A broadcast does not cross a router, so a relay is needed between subnets.
Blocking UDP 67 and 68 in the firewall. The exchange then fails at the first step.
Ignoring giaddr. On a relayed network the server picks the pool using it, so a missing network entry causes silence.
Check yourself
Work through these three questions.
What are the four DHCP messages in order?
Discover, Offer, Request and Acknowledge.
Which UDP ports do the server and client use?
The server uses UDP port 67 and the client uses UDP port 68.
What does the giaddr field tell the server?
It holds the relay address, which the server uses to choose the matching pool.
Topic 1 of 5 in DHCP Client, Relay and Server
Test yourself on DHCP Client, Relay and Server
The full MikroTik MTCTCE question bank has 479 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.