BOOTP

What is BOOTP?

BOOTP (Bootstrap Protocol) is a network protocol with which a device, at startup, broadcasts a request for its IP address, subnet mask, gateway and optionally the name of a boot file to a BOOTP server, which returns those settings from a fixed table based on the device’s MAC address. BOOTP is defined in RFC 951 from September 1985 and was designed for diskless workstations that had to boot without local storage. DHCP has largely replaced it in office networks, but BOOTP lives on in industry: many IP devices, I/O adapters and drives still request their first IP address through BOOTP or DHCP.

BOOTP is simple and predictable: the same MAC address always receives the same IP address. That makes it well suited to commissioning field devices, but the protocol has no form of authentication at all.

🧠 How does BOOTP work step by step?

BOOTP uses a single request and a single reply over UDP. The server listens on UDP port 67 and the client on port 68. According to RFC 951 the two ports are deliberate: a reply sent as a broadcast then does not needlessly wake up the BOOTP server processes on other machines.

1. BOOTREQUEST - the device does not yet know its own address and broadcasts a request to port 67 containing its MAC address (field chaddr) and a random transaction ID (xid).
2. Lookup - the BOOTP server looks up the MAC address in its table. If it is not listed, a pure BOOTP server simply does not reply.
3. BOOTREPLY - the server returns the assigned address (yiaddr), its own address (siaddr) and optionally the name of a boot file (file).
4. Second phase - a device that needs a boot file then downloads it with TFTP. RFC 951 explicitly calls BOOTP the first phase of a two-step bootstrap; both phases were meant to fit in a PROM.
5. Retry when there is no reply - the client tries again with a randomised, exponentially growing delay. RFC 951 gives the example of retries at roughly 4, 8, 16, 32 and 64 seconds after the first attempt; once the average delay reaches about 60 seconds, it grows no further. This stops a hundred devices that restart together after a power failure from flooding the network.

The fields of a BOOTP message add up to 300 bytes: a fixed 236-byte header plus the 64-byte vendor field (vend). RFC 1542 turned those 300 bytes into a minimum length. RFC 951 recommends starting the vend field with a 4-byte magic number; this later became the magic cookie 99.130.83.99. These vendor extensions for subnet mask, gateway and DNS server later became the options that DHCP still uses today.

📐 Which fields and values matter?

A broadcast does not pass a router. If the BOOTP server sits in another subnet, a relay agent is required. RFC 1542 (October 1993) defined how it works: the relay receives the request, fills giaddr with its own address, increments hops and forwards it as unicast to the server. On Cisco equipment this is done with the ip helper-address command, which by default also forwards a handful of other UDP services besides BOOTP/DHCP.

🔄 What is the difference between BOOTP, RARP and DHCP?

BOOTP sits between two generations. It replaced RARP (RFC 903, 1984), which could only request an IP address and, as a link-layer protocol, could not be routed. It was in turn succeeded by DHCP, whose first version appeared in 1993 and whose current basis, RFC 2131, was published in March 1997.

DHCP uses the same message format and the same ports. RFC 2131 even requires DHCP servers to keep serving existing BOOTP clients. A DHCP client, however, does not always work with a pure BOOTP server, because that server does not understand the DHCP message types. Conversely, Windows Server and most other DHCP servers can serve BOOTP clients; in Windows Server you set per reservation whether it supports DHCP, BOOTP or both.

🏭 Why do industrial devices still use BOOTP?

In OT networks, PLCs, IO modules, drives and HMIs almost always get a fixed address. BOOTP is not a permanent address service there, but a tool to set that fixed address for the first time.

• Rockwell Automation - many Allen-Bradley devices with EtherNet/IP request an address via BOOTP or DHCP when delivered or after a factory reset. The EtherNet/IP Address Commissioning Tool (and before it the older BOOTP-DHCP tool) shows the incoming MAC addresses, assigns an address and then switches the device to static mode.
• Phoenix Contact - the free IPAssign tool sets the IP address of devices that rely on BOOTP, without installation or administrator rights.
• Siemens - PROFINET devices from Siemens do not get their name and address via BOOTP but via PROFINET’s own DCP protocol, from TIA Portal or the Primary Setup Tool.

A well-known pitfall: a device left in BOOTP/DHCP mode often loses its address after a power interruption and asks again after the restart. If the tool or server is no longer there, the device stays unreachable and communication with the PLC drops. In addition, some managed switches block broadcast traffic to UDP 67/68, so the tool never sees the request.

🧭 How do you configure a device with BOOTP?

A practical approach when commissioning an EtherNet/IP adapter or drive:

1. Plan the address - record the IP address, mask and gateway in the address plan and your Asset Inventory, aligned with the cell’s subnet layout.
2. Work in isolation - connect the laptop running the BOOTP tool to the same VLAN or directly to the device. That way no other server responds and you only see the expected requests.
3. Check the MAC address - compare the MAC address shown in the tool with the label on the device before assigning an address.
4. Assign and lock - assign the address and immediately disable BOOTP/DHCP (static mode), in the tool or later via the device’s configuration software or parameters.
5. Test after a restart - cycle the power and check that the device keeps its address.
6. Clean up - stop the BOOTP tool and never leave a temporary BOOTP server running in the production network.

🔐 What security risks does BOOTP have?

BOOTP is not encrypted and has no authentication: client and server trust each other blindly. From a security perspective, it should therefore only be active when it is really needed.

• Rogue server - any device in the segment can answer a BOOTREQUEST. An attacker or a misconfigured laptop can hand out a wrong address, a wrong gateway or a different boot file. A rogue device running a BOOTP or DHCP service is therefore a real risk.
• MAC spoofing - because the server only looks at the MAC address, anyone who imitates that address can obtain another device’s IP address.
• Manipulated firmware - when the boot file is loaded via TFTP, the protocol does not check its integrity. Only firmware signing that the device verifies itself stops a forged file.
• Unwanted reconfiguration - a device that stays in BOOTP mode asks again after every restart. If a different or rogue server answers, it receives a different address or none at all.

Measures that work:

• Disable BOOTP/DHCP as soon as the address is fixed.
• Use DHCP Snooping on switches; it also inspects BOOTP traffic and only allows replies from trusted ports.
• Combine it with Port Security and IP Source Guard against MAC and IP spoofing.
• Limit broadcast domains with VLANs and network segmentation, and do not allow UDP 67/68 between zones in your Firewall rules (see firewall rule management).
• Detect unknown BOOTP servers with network monitoring.

❓ Frequently asked questions

Is BOOTP the same as DHCP?

BOOTP and DHCP use the same message format and the same UDP ports 67 and 68, but they are different protocols. BOOTP assigns a fixed address based on the MAC address without a lease, whereas DHCP hands out addresses dynamically with a lease time. DHCP is the successor to BOOTP and, under RFC 2131, must also serve BOOTP clients.

Which ports does BOOTP use?

BOOTP uses UDP port 67 for the server and UDP port 68 for the client. These are the same ports DHCP uses. A firewall or switch that blocks these ports therefore stops both BOOTP and DHCP traffic.

Why does my device lose its IP address after a restart?

A device in BOOTP/DHCP mode requests an address again at every startup and often loses its previous address after a power interruption. If no BOOTP server replies, the device remains unreachable. After the first BOOTP assignment, switch the device to static mode.

Does BOOTP work across routers?

BOOTP requests are broadcasts and do not pass a router. A relay agent, such as ip helper-address on a Cisco router, can however forward the request as unicast to a BOOTP server in another subnet. RFC 1542 describes how such a BOOTP relay works.

Is BOOTP secure in an OT network?

BOOTP has no authentication or encryption, so a rogue server or MAC spoofing can result in wrong addresses. In an OT network BOOTP is acceptable for one-off commissioning in an isolated segment. After that, BOOTP should be disabled, with DHCP Snooping and network segmentation protecting against misuse.

Do PROFINET devices use BOOTP?

PROFINET devices receive their device name and IP address via the PROFINET DCP protocol, not via BOOTP. BOOTP is mainly found on EtherNet/IP devices and on devices from manufacturers such as Rockwell Automation and Phoenix Contact. Some devices support several methods side by side.

📌 In summary

BOOTP is the 1985 protocol with which a device, at startup, receives a fixed IP address and boot information from a server based on its MAC address. DHCP has replaced it in IT, but in OT BOOTP is still commonly used to address field devices for the first time. Use it only during commissioning in an isolated segment, disable it afterwards and protect the network with DHCP Snooping and segmentation.