DHCP: the vehicle registration office hands out licence plates
Welcome back to our Packet Highway, commonly known as the Internet!
Life at the Quiet Network Estate is slowly returning to normal. The NAT gatekeeper is still hunting for his notebook. The computer and printer have settled their licence plate dispute, although the printer has printed nothing but formal complaints about damaged reputations ever since. The smart fridge still hasn't found the milk.
But today all the residents face a real challenge.
A visit to the vehicle registration office.
Good morning, I'd like a number, please
At seven in the morning a queue forms outside the office: a computer, a laptop, a phone, a games console, and a small toaster that's only come to ask about opening hours.
Behind the window sits the DHCP clerk. On his desk are a stamp, a cup of tea, and a huge binder labelled:
“ADDRESSES TO ISSUE — DO NOT HAND THEM ALL OUT AT ONCE”.
The laptop steps up first.
— Good morning. I need some licence plates.
— Certainly. What number?
— I don't know.
— Then why are you here?
— SO YOU CAN GIVE ME ONE!
— Ahhh. You should have said so.
The clerk opens his binder.
— I've got 192.168.1.100. Will that do?
— Is it a nice one?
— It's numerical.
— Is it available?
— Yes.
— I'll take it!
— Just a moment. First, the paperwork.
— WHAT PAPERWORK?!
— We need to go through DORA.
— WHO'S DORA?!
— Four steps.
— FOUR STEPS TO GET SOME PLATES?!
— Welcome to network administration.
Meet DHCP (Dynamic Host Configuration Protocol) — the mechanism that allows devices to obtain an IP address and other network settings automatically.
DORA, or four counters for one rubber stamp
The laptop doesn't have an address yet. It doesn't even know where the appropriate clerk is sitting.
So it goes outside and shouts:
— HELLO! IS ANYBODY HERE HANDING OUT ADDRESSES?!
A head appears at the window.
— ME!
— WHAT HAVE YOU GOT?!
— 192.168.1.100!
— I'LL TAKE IT!
— APPROVED!
The laptop stares.
— Is that all?
— That's all.
— Then why did I have to go through four stages?!
— So we know who promised what to whom.
In DHCPv4 the four stages are:
| DORA | The licence plate procedure |
|---|---|
| Discover | “HELLO! IS THERE AN OFFICE AROUND HERE?!” |
| Offer | “WE HAVE A NUMBER FOR YOU!” |
| Request | “I'LL TAKE THAT NUMBER!” |
| Acknowledge (ACK) | “APPROVED! NEXT!” |
At first, a client often uses broadcast because it doesn't yet have its proper IPv4 address and must find a DHCP server.
— SO I HAVE TO SHOUT AT EVERYBODY?!
— Often, at first.
— EVEN THE NEIGHBOURS?!
— They can hear it too.
— THE FRIDGE?!
— Unfortunately, yes.
A voice rings out in the distance:
— DOES ANYBODY KNOW WHERE THE MILK IS?!
— MADAM, THAT'S THE WRONG PROTOCOL!
Those plates aren't yours. They're leased
The laptop happily goes home. An hour later it discovers a line in the paperwork:
Assignment valid for: 24 hours.
It races back to the office.
— EXCUSE ME!
— Yes?
— Why are my plates valid for only one day?!
— You received a lease.
— A WHAT?!
— An IP address lease.
— BUT I WANT TO LIVE HERE PERMANENTLY!
— You can. You just need to renew your paperwork.
— EVERY DAY?!
— The system usually handles it automatically.
— THEN WHY ARE YOU TELLING ME?!
— So you know the plates don't belong to the car.
This is a DHCP lease. The server grants an address for a limited period, and the client can ask to renew it.
In a typical DHCPv4 setup, a client starts renewal around halfway through the lease, at a point called T1.
— SO IF I'VE GOT A DAY, I ASK AGAIN AFTER TWELVE HOURS?!
— Usually, yes.
— BUT I'VE STILL GOT TWELVE HOURS!
— That's precisely why we ask early.
— AND IF YOU DON'T ANSWER?!
— Later you can try a broader renewal at T2.
— AND IF NOBODY ANSWERS THEN?!
— Once the lease expires, you can't assume the address is still yours.
— YOU'LL TAKE MY PLATES OFF WHILE I'M DRIVING?!
— Don't be dramatic.
— YOU JUST SAID I COULD LOSE MY NUMBER MID-JOURNEY!
— Which is why we recommend not ignoring deadlines.
— I HATE GOVERNMENT OFFICES!
A fixed number, still issued by the office
The following day, a server arrives. Very serious. Wearing a suit. Carrying a briefcase.
— Good morning. I require a permanent address.
— You can configure one manually.
— I don't want to.
— Then what do you want?
— I want you to assign me the same one every time.
— Ah. A DHCP reservation.
— Exactly.
— I'll need your device identifier.
— Here you are.
The server provides its MAC address. The clerk writes:
AA:BB:CC:DD:EE:10 → 192.168.1.10
— Done. When you request an address and we recognise you by this reservation, you'll get that number.
— Excellent.
— Remember, DHCP is still managing the assignment.
— But the number stays the same?
— As long as the administration maintains the reservation and the configuration permits it.
— Can you delete my reservation?
— Technically, yes.
— THEN RESERVE IT FOREVER!
— Please submit an application.
— TO WHOM?!
— The administration.
— BUT YOU ARE THE ADMINISTRATION!
— I'm just the DHCP server. 🤣
There's an important difference between a manually configured static IP and a DHCP reservation. Both can give you a consistent number, but they work differently.
Sorry, we're out of numbers
One lovely morning the estate holds a smart-device sale.
Residents buy thermometers, televisions, sensors, lightbulbs, vacuum cleaners, speakers and coffee machines that order coffee by themselves.
Two hundred new cars appear outside the registration office.
— NEXT!
— AN ADDRESS, PLEASE!
— NEXT!
— AN ADDRESS, PLEASE!
— NEXT!
— AN ADDRESS, PLEASE!
An hour later the clerk opens the binder. Turns a page. Another. A third.
— Hmm.
— WHAT DO YOU MEAN, “HMM”?!
— We've run out of addresses.
— HOW CAN YOU RUN OUT?!
— All addresses in the available pool have been assigned.
— THEN GET ANOTHER BINDER!
— We don't have one.
— THEN PRINT SOME MORE!
— I can't assign numbers outside the configured pool.
— BUT I BOUGHT A SMART VACUUM CLEANER!
— Congratulations.
— IT CAN'T GET ON THE INTERNET!
— Then for now it can just vacuum.
This is DHCP pool exhaustion.
Addresses may be occupied by active leases, reserved for specific devices, or excluded from allocation. New devices may then fail to receive the expected configuration.
— THEN TAKE AN ADDRESS AWAY FROM SOMEONE WHO ISN'T USING IT!
— We'll recover available addresses under the lease rules.
— WHAT ABOUT MY VACUUM?!
— It can still vacuum.
— WITHOUT THE CLOUD IT DOESN'T KNOW WHERE THE KITCHEN IS!
— Kitchens are usually near fridges.
— THE FRIDGE ISN'T WORKING EITHER!
— At least you know where to look for it.
Two clerks, one car
One day the estate manager discovers a second registration office on the pavement.
Nobody built it. Nobody authorised it. It's simply there.
A small device with antennas peers out of the window.
— Hello! I hand out addresses too!
The main DHCP clerk steps outside.
— EXCUSE ME, WHO ARE YOU?!
— A little Wi-Fi router.
— WHY ARE YOU HANDING OUT ADDRESSES?!
— Because I have that feature!
— WHO AUTHORISED YOU?!
— The factory.
— BUT THIS IS MY ESTATE!
— Didn't know.
A new laptop arrives.
— HELLO! WHO'S GOT A NUMBER FOR ME?!
From the first window:
— 192.168.1.120!
From the second:
— 192.168.0.120!
— WHICH ONE?!
— MINE! — shouts the first.
— MINE IS PRETTIER! — answers the second.
The laptop accepts the second offer.
— WHERE'S THE GATEWAY?!
— 192.168.0.1!
— BUT THERE'S NO HIGHWAY THERE!
— Not my problem.
Meet a rogue DHCP server — an unauthorised server issuing network settings.
On the same broadcast domain, two independently configured DHCP servers may answer clients.
That isn't automatically a disaster — there are valid setups with multiple DHCP servers — but an accidental router can hand out the wrong addresses, gateways or DNS servers.
— HOW DO WE KNOW WHICH OFFICE IS REAL?!
— The administrator can use protections such as DHCP snooping on suitable switches.
— WHAT'S SNOOPING?!
— Controlling which switch ports may send DHCP server responses.
— SO YOU'RE INSPECTING THE CLERKS?!
— Exactly.
— FINALLY, A SENSIBLE INSTITUTION!
The office is too far away to hear us
The Quiet Network Estate has grown. New districts have appeared, each with its own network and a road manager separating it from the others.
In a new district, a computer tries to get an address.
— HELLO! ANY DHCP OFFICE THERE?!
Silence.
— HELLOOOOOO!
Silence.
— VEHICLE REGISTRATION!!!
The nearby gate manager sticks his head out.
— Please stop shouting.
— BUT NOBODY CAN HEAR ME!
— The office is on another network.
— THEN CALL THEM FOR ME!
— I can forward your application.
— HOW?!
— Using DHCP Relay.
The manager receives the request and forwards it to a DHCP server elsewhere. The office prepares a response and sends it back through the intermediary.
— Oh! I've got a number!
— You're welcome.
— SO YOU'RE A POSTMAN?!
— A DHCP relay agent.
— WHAT'S THE DIFFERENCE?!
— A postman doesn't need to understand subnet configuration.
DHCP Relay allows clients on different networks to be served without installing a separate DHCP server on every network.
The relay supplies the necessary information so the server can identify the originating subnet and select the appropriate address pool.
— SO ONE OFFICE CAN SERVE AN ENTIRE CITY?!
— Certainly.
— AND IF IT BREAKS?!
— That's a separate chapter about high availability.
— NO! NO MORE CHAPTERS!
Not just plates. A map and a phone book too
One day a computer returns from the office with all its documents.
— I'VE GOT AN IP ADDRESS!
— Great.
— I'VE GOT A SUBNET MASK!
— Excellent.
— I'VE GOT A DEFAULT GATEWAY!
— Wonderful.
— I'VE GOT DNS SERVERS!
— Congratulations.
— WHAT'S DNS?!
— The Internet's address book.
— WHY WOULD I NEED A BOOK?!
— So you don't have to remember everybody's numbers.
— BUT I'VE JUST BEEN GIVEN A NUMBER!
— Yours. Not everybody else's.
— AAAAAA!
DHCP can supply more than an IP address and subnet mask: it can also provide a default gateway, DNS server addresses, and many other configuration options.
So the administrator doesn't have to explain to every new car where the exit is and which office to ask when looking for a particular address.
And now IPv6. Naturally, the office had to expand
One morning a smartly dressed IPv6 representative arrives.
— Good morning. I'd like to introduce a modern address allocation system.
The IPv4 clerk doesn't even look up.
— We already have DHCP.
— We have DHCPv6.
— WHAT'S THE DIFFERENCE?!
— Among other things, how it works and which types of information it provides.
— SO JUST A BIGGER NUMBER?
— Not quite.
— OF COURSE NOT.
— Addresses can also be configured using SLAAC.
— USING WHO?!
— Stateless Address Autoconfiguration.
— WHICH MEANS?!
— A car can create its own address from information announced on the network.
— THEN WHY ARE YOU HERE?!
— Because DHCPv6 is still useful.
— DO YOU HAND OUT THE DEFAULT GATEWAY TOO?!
— Usually that information comes from Router Advertisements.
— SO WE'VE GOT DHCPv6, SLAAC AND RA?!
— Yes.
— COULDN'T YOU JUST HAND OUT THE PLATES?!
— We can. The system is more flexible, though.
— I HEARD THAT WORD DURING THE LAST REORGANISATION!
IPv6 commonly uses SLAAC and RA (Router Advertisement) messages for automatic configuration.
DHCPv6 can also assign addresses or additional configuration information, depending on the network.
An important distinction: standard DHCPv6 doesn't provide the default gateway in the same way DHCPv4 does. Router information usually arrives through RA.
— WHY DOES A DEVICE NEED SEVERAL IPv6 ADDRESSES?!
— Different addresses can serve different purposes.
— WHAT ABOUT THE FRIDGE?!
— It has a local address, a global one, and a temporary one.
— AND THE MILK?!
— STILL NO DATA.
Please return the address you no longer use
The working day is ending. A laptop pulls up to the window.
— Hello. I'm returning my plates.
— Why?
— I'm moving away.
— Ah. Very well.
The clerk receives the documents and records that the address has been released.
This is DHCP Release — a client can inform its server that it is giving up a lease.
— WHAT IF SOMEONE DRIVES AWAY WITHOUT TELLING US?!
— Leases have expiry dates.
— AND THEN WE GET THE NUMBER BACK?!
— After the appropriate time, the server may make it available again.
— WHAT IF THE DRIVER SUDDENLY RETURNS?!
— They'll need to determine which address they're now allowed to use.
— AND IF SOMEONE ELSE HAS THEIR OLD PLATES?!
— They shouldn't use those plates without checking.
— SO HAVING AN OFFICE IS ACTUALLY USEFUL?!
— Finally, someone said it.
What does DHCP really do?
DHCP automates network configuration and the management of allocated addresses.
On our highway, that looks like this:
| Mechanism | On our estate |
|---|---|
| DHCP Discover | Searching for the registration office |
| DHCP Offer | Offering a licence plate number |
| DHCP Request | Asking to use a chosen address |
| DHCP ACK | Approving the assignment |
| Lease | Renting a number for a limited time |
| Reservation | Holding a number for a recognised vehicle |
| Pool | Available plates waiting to be issued |
| DHCP Relay | A courier passing requests to a distant office |
| Rogue DHCP | An unauthorised office issuing its own documents |
| DHCP Release | Voluntarily returning an assigned address |
| DHCPv6 | Address and option allocation for IPv6 |
| SLAAC | Self-configuring an IPv6 address from network information |
Of course, IP addresses can also be configured manually. DHCP isn't mandatory on every network.
But it's wonderfully convenient when devices are constantly arriving and leaving, and the administrator has no intention of personally screwing licence plates onto every new toaster.
To explore more of our Packet Highway, take a look at IP addresses, DNS, NAT.
Meanwhile, at the registration office...
The clerk puts down his stamp. Closes the binder. Turns off his computer.
He's about to leave when the smart fridge pulls up.
— Good evening.
— Office is closed.
— I'd like to renew my lease.
— Tomorrow.
— But my address expires today!
— The system should have renewed it earlier.
— I tried.
— And?
— It didn't work.
— WHY?!
— I didn't have a network connection.
— WHY DIDN'T YOU HAVE A CONNECTION?!
— Because I didn't have an IP address.
The clerk slowly sits down.
— Wait... You didn't have an address because you couldn't connect to the network?
— Yes.
— And you couldn't connect because you didn't have an address?
— Yes.
— ...
— May I ask one more question?
— NO.
— But it's important.
— WHAT?!
— Have you seen my milk?
— MADAM, I HAND OUT ADDRESSES, NOT DAIRY PRODUCTS!!!
— Then why does the door say “DHCP”?
— BECAUSE IT STANDS FOR DYNAMIC HOST CONFIGURATION PROTOCOL!
— Oh.
A moment of silence.
— So it doesn't mean Delivery of Hot Chocolate and Pastries?
The clerk looks at his stamp. At his binder. At the fridge.
— TOMORROW I'M MOVING TO DNS. AT LEAST THEY LOOK UP THINGS BY NAME!
Someone shouts from the next office:
— DON'T COME HERE! WE'VE BEEN LOOKING FOR A SERVER THAT DOESN'T EXIST ALL MORNING!
— I'D RATHER GO HANG OUT THE LAUNDRY!!! 🤣🤣
Next time we can visit TCP and UDP, our two delivery companies. One won't leave without a receipt, while the other drove off ages ago and nobody knows where.
The registration office announces that issuing addresses has been temporarily suspended. The rubber-stamp ink has run out.