DHCP Analysis

A case study on how a client obtains network configuration through DHCP and why that process matters when a device cannot get online.

Overview

The capture shows DHCP messages exchanged between a client and a local DHCP server/router. The key behavior is the Discover, Offer, Request, and ACK sequence that assigns usable IP configuration to the client.

Objective

Trace the DHCP address assignment workflow, identify the transport ports and broadcast behavior, and connect DHCP fields to common connectivity failures.

Environment / Scenario

ToolWireshark

ProtocolsDHCP over UDP, IPv4, Ethernet/Wi-Fi

Client behaviorStarts without a confirmed IP address

Server/router192.168.2.1

What I Investigated

The four-message DHCP assignment flow.
UDP source and destination ports used by DHCP clients and servers.
Why early DHCP messages use 0.0.0.0 and 255.255.255.255.
The offered client address, transaction ID, lease behavior, router option, and subnet mask.

Key Observations

DHCP uses UDP, with the client using port 68 and the server using port 67.
The initial Discover message uses source IP 0.0.0.0 because the client has not yet been assigned an address.
Broadcast destination 255.255.255.255 is used while the client is still being configured.
The server offers 192.168.2.195, and the same transaction ID ties the first Discover/Offer/Request/ACK exchange together.
Router and subnet mask options are important because they tell the client how to reach local and off-subnet destinations.

Annotated Screenshots

DHCP Discover Offer Request ACK timing diagram — This comparison demonstrates the DHCP Discover, Offer, Request, and ACK flow using client port 68 and server port 67.

Wireshark DHCP Discover broadcast — Wireshark capture showing a DHCP Discover from 0.0.0.0 to 255.255.255.255. The client is broadcasting because it does not yet have a confirmed IP configuration.

Wireshark DHCP Offer with offered IP address — Wireshark capture showing the DHCP server offering 192.168.2.195 to the client. This is the address the client can request before the lease is finalized.

Wireshark DHCP ACK — This frame illustrates the ACK stage, where the server confirms the client lease and completes the assignment process.

Why It Matters for Troubleshooting

DHCP failures are a common reason devices cannot join a network. If a client sends Discover messages but receives no Offer, the issue may involve server availability, VLAN scope, wireless isolation, relay configuration, or filtering. If the client receives an Offer but does not complete the exchange, the issue may involve address conflicts, lease handling, or client-side configuration.

Key Takeaways

DHCP turns a device with no usable IP address into a configured network participant.
Transaction IDs help match client requests with server responses.
Router, subnet mask, and lease options are as important as the assigned IP address.