Overview
DHCP assigns addresses through a specific four-step exchange, often remembered as DORA. Knowing this handshake explains how a device goes from no address to a fully configured one, and how leases are renewed. This lesson walks through the lease process.
Learning objectives
- Describe the four steps of the DHCP DORA process.
- Explain what a lease is and how it is renewed.
- Understand broadcast behavior during discovery.
Core concept
A new client obtains a lease through four messages — DORA:
- Discover — the client broadcasts a DHCP Discover, since it has no address yet and does not know the server.
- Offer — a DHCP server responds with an Offer proposing an address and settings.
- Request — the client broadcasts a Request, formally asking for the offered address (also signaling other servers that it declined their offers).
- Acknowledge — the server sends an Ack confirming the lease; the client applies the configuration.
The assignment is a lease — valid for a limited lease time, after which it must be renewed or it expires.
How it works
Because the client starts with no IP, the initial Discover and Request are broadcasts (it cannot yet address a specific server). Once leased, the client does not wait for expiry to renew: it typically attempts renewal partway through the lease (commonly around the halfway point) by contacting the server directly. If the server is reachable, the lease is extended; if not, the client keeps trying and, failing that, eventually relinquishes the address when the lease expires.
Practical example
A phone joins a network: it broadcasts Discover, the DHCP server replies with an Offer of 192.168.1.50, the phone Requests that address, and the server Acks with a lease time of, say, 24 hours. The phone uses 192.168.1.50 and, about halfway through the lease, quietly renews it in the background so its connectivity never lapses.
Cybersecurity relevance
The DORA exchange is visible on the network and relevant to security. Because Discover/Request are broadcast and unauthenticated, a rogue server can race to Offer malicious settings, and DHCP starvation attacks exhaust the address pool by flooding Discover messages with spoofed identities. Analysts recognize abnormal DORA patterns (floods, unexpected servers) as indicators, and DHCP snooping enforces which servers may Offer.
Common mistakes
- Misremembering the order — it is Discover, Offer, Request, Acknowledge (DORA).
- Thinking a lease lasts forever — it has a finite lease time and must be renewed.
- Forgetting the initial messages are broadcasts because the client has no address or known server yet.
Key takeaways
- DHCP assigns addresses via the four-step DORA exchange: Discover → Offer → Request → Acknowledge.
- Assignments are time-limited leases; clients renew partway through the lease rather than waiting for expiry.
- The unauthenticated, broadcast-based exchange underlies rogue-server and starvation attacks, mitigated by DHCP snooping.
Check your understanding
- Name the four DORA steps in order and say which are broadcast.
- Roughly when does a client normally try to renew its lease, and what happens if the server is unreachable?