---
{
  "title": "DHCP",
  "summary": "Learn how DHCP assigns IPv4 configuration, how leases affect investigations, and why obtaining an address does not authenticate a network.",
  "topic": "networking",
  "level": "Beginner",
  "updated": "2026-10-12",
  "units": [
    2
  ],
  "aliases": [],
  "sources": [
    {
      "title": "Cisco: Networking basics",
      "url": "https://www.cisco.com/site/us/en/learn/topics/networking/what-is-computer-networking.html"
    },
    {
      "title": "IETF: Dynamic Host Configuration Protocol, RFC 2131",
      "url": "https://www.rfc-editor.org/rfc/rfc2131.html"
    }
  ],
  "published": "2026-10-02",
  "editorialVersion": 2
}
---

## Configuration has a lifecycle

Dynamic Host Configuration Protocol, or DHCP, can provide hosts with IPv4 addressing and other network configuration. Common options include information about a default gateway and DNS resolvers. An assigned address is typically associated with a lease rather than an assumption of permanent ownership.

The original DHCP protocol discussed here concerns IPv4. IPv6 configuration has separate mechanisms and must not be inferred directly from an IPv4 example. [[ip-addressing]] explains the broader addressing context.

## A laptop joins a classroom network

Imagine a fictional learner connects a new laptop to an academy lab. In a typical initial IPv4 allocation, the client discovers available servers, receives an offer, requests an allocation, and receives an acknowledgment. These steps are commonly remembered as Discover, Offer, Request, Acknowledge.

That sequence is a learning model for initial allocation, not a claim that every later exchange repeats all four steps. A client may renew an existing lease or use other protocol behavior depending on its state and the server's response.

After configuration, the laptop still needs working paths and services. Receiving an address does not guarantee that name resolution, internet connectivity, or the training application will work.

## One option can change the journey

Suppose the learner receives an unexpected DNS resolver or gateway. The device might send future traffic or naming requests through infrastructure different from the academy's intended configuration. An analyst should compare the obtained options with the approved network design.

DHCP allocation alone does not authenticate the entire network. Protecting the configuration path and monitoring unauthorized infrastructure are separate operational concerns. Platform-specific protections can help, but their availability and correct use depend on the network equipment and topology.

For the learner, the useful response is reporting and documenting the unexpected configuration, rather than experimenting with changes on a shared production network.

## Leases are time-dependent evidence

An address observed yesterday might belong to a different device today. During an investigation, record lease start and end information, the relevant client identifiers, server context, and event time. Avoid matching a historical incident to the current lease table without checking the timeline.

Client identifiers and hardware addresses are also evidence with limitations, not universal proof of a person's identity. Combine them with other records where the investigation requires attribution. [[incident-timeline]] develops this distinction between observation and conclusion.

## Inspect without disrupting allocation

In a lab you control, inspect a device's current address, prefix, gateway, resolver, and lease information. Explain what each value is used for and which source supplied it. Do not release or alter other users' leases as a learning exercise.

Then draw a case where address allocation succeeds but the configured resolver fails. Identify why [[dns]] troubleshooting differs from DHCP troubleshooting. Continue with [[routing-and-switching]] to connect the received gateway configuration to packet delivery. The practical skill is following configuration through its operational effects and its changing ownership over time.