Lesson 4.3: DHCP: how devices get their network settings
Why you never type an IP address when you join a Wi-Fi network: DHCP hands out an address, mask, gateway and DNS server for a limited time (a lease) in four steps (Discover, Offer, Request, Acknowledge). And why that's a security matter: a rogue DHCP server can make itself everyone's gateway and DNS. In the lab you see that your address came from DHCP, read your lease, follow the four messages in a capture and spot a second server that shouldn't exist.
17 min
You will learn to
- Explain what DHCP provides
- Describe the DORA exchange
- Read a DHCP lease
- Recognise a rogue DHCP server
- Name defences such as DHCP snooping
Key terms
- DHCP
- A service that gives devices their network settings automatically: address, mask, gateway, DNS servers and more.
- DORA
- The four messages of getting an address: Discover (anyone there?), Offer (take this), Request (I'd like that one), Acknowledge (it's yours).
- Lease
- The time a device may use its address before renewing it.
- DHCP options
- The extra settings in a DHCP answer, each with a number: 3 router, 6 DNS servers, 51 lease time, 54 server identifier.
- Rogue DHCP server
- An unauthorised DHCP server on the network, by mistake or on purpose, handing out wrong settings.
- DHCP snooping
- A switch feature that lets DHCP answers in only from ports marked as trusted, so a rogue server's offers never reach clients.
← Wildcards and path expansion · All lessons · Patching, backups and logging: the boring controls that save you →