DHCP

What is DHCP?

DHCP (Dynamic Host Configuration Protocol) is a network protocol with which a server automatically assigns an IP address, subnet mask, default gateway, DNS servers and other network settings for a limited time (a lease) to devices that join an IP network. As a result, nobody has to configure laptops, printers or phones by hand, and duplicate addresses are avoided. DHCP is defined in RFC 2131 (March 1997) and builds on the older BOOTP. In office networks it is the default; in OT networks its use is deliberately more limited, because PLCs, HMIs and SCADA servers need a predictable address.

Thanks to DHCP, neither user nor administrator needs to perform manual IP configuration, but whoever controls the DHCP server also decides where a device’s traffic goes.

🎯 How does DHCP work step by step?

DHCP runs over UDP: clients send to port 67 (server) and servers reply to port 68 (client). A device without an address goes through four steps, often abbreviated as DORA:

1. Discover - the client sends a broadcast: “is there a DHCP server here?”
2. Offer - one or more servers offer a free address from their range, together with the associated settings.
3. Request - the client picks one offer and formally requests that address; other servers thereby see that their offer was declined.
4. Acknowledge (ACK) - the server confirms and the lease starts.

The client then checks with an ARP request whether the address is really free. If another device responds, the client sends a DHCPDECLINE and the server marks the address as unusable. The other messages are DHCPNAK (refusal, for example after moving to another subnet), DHCPRELEASE (returning the address) and DHCPINFORM (requesting only settings for a device with a fixed address).

Lease renewal happens automatically. By default the client tries to renew with its own server after 50% of the lease time (T1). If that fails, it tries again after 87.5% (T2) by broadcasting to any server. If the lease still expires, the device must stop using the address. If a client receives no answer at all, many operating systems pick a link-local address from 169.254.0.0/16 themselves, which in practice is often the first sign of an unreachable DHCP server.

🔧 What components and options make up DHCP?

All settings other than the address itself are carried as numbered options:

🔄 What is the difference between DHCP, BOOTP and a static address?

BOOTP (RFC 951, 1985) is the predecessor: it hands out a fixed address based on the MAC address, without leases. DHCP is compatible with it, so many DHCP servers also serve BOOTP clients. For IPv6 there is DHCPv6 (RFC 8415, 2018), with its own messages (Solicit, Advertise, Request, Reply) and ports 546 and 547; there the default gateway comes from router advertisements, not from DHCPv6.

🏭 How is DHCP used in OT environments?

In industrial networks static IP addressing is common. A controller that receives a different address after a restart becomes unreachable for SCADA and other PLCs, and a failed DHCP server must never stop a production line. Even so, DHCP has a fixed place:

• Commissioning - many IP devices ship with BOOTP or DHCP enabled, so the engineer sets the first address with a BOOTP/DHCP tool and then switches the device to static.
• Port-based assignment - managed switches from vendors such as Cisco, Moxa and Hirschmann can hand out a fixed address per port, or pass the port to the server via option 82. A replaced sensor or drive thus automatically receives the same address, without configuration by the technician.
• Temporary devices - maintenance laptops in a separate VLAN or engineering network, and visitors on the guest network.
• Supervisory and IT layers - workstations and thin clients at level 3 of the Purdue Model often receive an address from a reservation.

Mind the dependency, though: with port-based assignment the cabling determines the address. If a device is plugged into the wrong port, it gets the wrong address.

🔐 What security risks does DHCP have?

In practice DHCP has no authentication: a client trusts the first answer that arrives. MITRE ATT&CK describes abuse of this as DHCP Spoofing (T1557.003).

A DHCP reservation by MAC address is an administrative measure, not a security control: a MAC address is easy to forge (Spoofing). Place DHCP servers for OT in their own zone in line with IEC 62443, not in the office network.

🧭 How do you set up DHCP responsibly in an OT network?

A practical approach in five steps:

1. Document the address plan - per zone and VLAN: which ranges are static, which are reserved and which are dynamic. Record it in your asset inventory.
2. Choose a separate DHCP function per zone - on the switch or on a server inside the zone, so that an IT outage does not affect production. Make the server redundant where production depends on it.
3. Enable DHCP Snooping - mark only the ports towards the real server as trusted and build IP Source Guard and Dynamic ARP Inspection on top of it.
4. Choose suitable lease times - short (hours) for guest and maintenance networks, long or reserved for fixed equipment.
5. Log and monitor - send leases and snooping alerts via Syslog to your SIEM or network monitoring; an unknown MAC address or a second DHCP server is an immediate signal.

Also check the lifecycle of the server software. ISC DHCP, for years the standard on Linux, has been end-of-life since the end of 2022; its successor is Kea. For organisations within the scope of the Dutch Cybersecurity Act (NIS2), such core services belong in the patch policy and the hardening baseline.

❓ Frequently asked questions

Which ports does DHCP use?

DHCP uses UDP port 67 for the server and UDP port 68 for the client. DHCPv6 for IPv6 uses UDP port 546 for clients and 547 for servers and relay agents. Firewall rules between zones must therefore allow or block these ports specifically.

What happens if the DHCP server fails?

Devices with a valid DHCP lease keep using their address until the lease expires; after 50% and 87.5% of the lease time they try to renew. New or restarted devices get no address and often fall back to a link-local address in 169.254.0.0/16. That is why critical OT devices usually use a static address.

Is DHCP secure enough for an OT network?

DHCP itself has no authentication, so a rogue DHCP server can give devices a false gateway or DNS server. With DHCP Snooping, IP Source Guard, Dynamic ARP Inspection and a DHCP server per zone, DHCP can be managed well in OT. For PLCs and SCADA servers, static addressing remains the usual choice.

What is the difference between a DHCP reservation and a static IP address?

With a DHCP reservation the DHCP server always binds the same address to a MAC address or client ID, but the device remains dependent on the server. With a static IP address the configuration is stored on the device itself and no server is needed. A reservation is easier to manage centrally; a static address is more robust when something fails.

What is DHCP option 82?

DHCP option 82, the Relay Agent Information Option from RFC 3046, lets a switch or relay tell the server through which port and device a DHCP request arrived. The DHCP server can then hand out a fixed address per switch port. In OT this means a replaced device on the same port automatically receives the same address.

What is a DHCP relay?

A DHCP relay is a router or switch that forwards DHCP broadcasts from a subnet to a DHCP server in another subnet, because broadcasts normally do not cross routers. This allows one server to serve multiple VLANs. In OT networks you must decide deliberately whether relay traffic may cross zone boundaries.

📌 In summary

DHCP automates the distribution of IP addresses and network settings through a four-step process with temporary leases. It simplifies management, but without authentication whoever controls the DHCP server decides where traffic goes. In mixed IT/OT networks, use static addresses or reservations for critical equipment, a DHCP function per zone and DHCP Snooping on every access switch.