How a Computer Gets an IP Address from the DHCP Server (DORA)

 What happens if your computer doesn't have an IP (Internet Protocol) address? Certainly, you will not be able to do the things you commonly do. Such as surfing the web, using social media, and connecting to your college applications online. IP addresses do not come pre-loaded with our system; it is assigned to us either from our ISP or from our local network DHCP server. 

We will look at how the actual process works and how the DHCP servers assign us an IP address.

Below is the snippet showing the four steps involved in this process. These four steps are abbreviated with DORA (Discover, Offer, Request, Accept). 

with
 Image source: Wireshark interface

 Let's start with the Discover step first, the first packet in our snippet. Here, you can see the source IP address is 0.0.0.0, which is our system address. Note that we still don't have an IP address yet, which is why it shows 0.0.0.0. The destination address is a broadcast address 255.255.255.255, sending the message to all ports in the network to find (discover) the DHCP server, so that it can be assigned a valid IP address.  

The second step in the process is the Offer. Here, the source IP address is of our DHCP server 192.168.0.1; it can also be of the router (depending on your network, how it is set up, because some routers have the capabilities of assigning IP addresses to clients without depending on a separate DHCP server). The destination address is 192.168.0.10, which is what the DHCP has offered the client. Note that the client has not accepted the offer yet. You can also see below the lease time of the IP address, which is 1 hour; after that time, the client has to renew the lease. There are some other options that the DHCP server has offered, such as subnet mask and more.  

 Image source: Wireshark interface

The third step is the Request. Again, the source IP address is our computer address, which is still 0.0.0.0, and the destination IP address is 255.255.255.255. You may be thinking why the destination IP address is a broadcast address and not the DHCP server's own address which is 192.168.0.1, it is because before the client can request the DHCP server for the new IP address, the client have to make sure nobody else in the network has the same IP, that's why it broadcasts its request to every port on the network and if nobody replies then it proceed on its way to the DHCP. You can see the requested IP address below, which our client is requesting.

In simple terms, our computer is letting everybody know that "hey, I'm getting this IP, nobody else is using it, right? And when everybody says no, then the computer proceeds with its request.

 Image source: Wireshark interface

In the last step, the Acknowledge step, the DHCP server acknowledges or accepts the request and assigns the IP address to our computer 192.168.0.10. You can also see some other options the DHCP server has provided, like subnet mask, lease time, and renewal time (it is the time the computer starts the process of renewing its lease; obviously, the computer will not wait until the last minute to renew its IP address, so 30 minutes before the lease expires it will start the renewal process).

 Image source: Wireshark interface

If you have any questions, drop them down below, and I will be happy to answer them. 


Comments

Post a Comment

Popular posts from this blog

Extracting JPEG Images from the network (Wireshark)

Image
 We work with image formats like JPEG all the time—for example, when uploading pictures to a server, downloading them from the internet, or sending photos to friends through email and other platforms. Using Wireshark, we can easily monitor our network traffic and see who is sending or receiving image files across the network. This is especially useful for analyzing data transfers and understanding how files move over HTTP or other protocols. Below is a sample capture that includes JPEG images. While you may not immediately see the image packets, they will become visible once we apply the appropriate filters in Wireshark.             Image source: Wireshark interface Once you apply the filter command, you'll see results similar to the example below—showing only HTTP traffic that contains JPEG image content.             Image source: Wireshark interface Keep in mind that JPEG files can be transferred using variou...
Read more
Image
Wireshark (capturing traffic) Given that you have already downloaded and installed Wireshark on your PC (here's the link if you have not  https://www.wireshark.org/docs/wsug_html_chunked/ChBuildInstallWinInstall.html ), this is the screen where you will end up once you open Wireshark.     Image source: Wireshark interface   Arrow 1 : From here you can choose the interface you want to capture the traffic from, in my case I only have traffic on my WIFI interface (as you can see the spikes, right next to it), the bottom one is the loopback traffic interface it shows traffic going from your device to itself. The other options are LAN (Ethernet options).  Arrow 2: Once you click your interface (WIFI), click the blue shark fin, and this will start your network traffic capture.      Image source: Wireshark interface After clicking the blue shark fin button, it will bring you to this screen, and you can see all the traffic generating. ...
Read more
Image
 Wireshark (What is middle pane in Wireshark?) As we mentioned in the previous post, we would cover the middle pane in Wireshark. In this post, I’ll briefly go over a few elements in each section of that pane. But before that, I’d like you to review the OSI model (shown below). You may be surprised, but the middle pane in Wireshark is actually organized in the same sequence as the OSI model — from bottom to top.                   Image source: Wireshark interface I have randomly selected this packet — it’s a TCP packet. The packet is highlighted in red because the connection was reset (as indicated by the RST flag in the Info column). There could be a variety of reasons for this, but most commonly, it’s due to latency issues or an application crash.  Image source: Wireshark interface The first section is the Frame, which corresponds to the Physical layer of the OSI model. This is where the actual conversion of bits into electr...
Read more