Study Guide
DHCP and ARP
A worked DHCP lease exchange and ARP examples for a local printer and a remote server's next-hop gateway.
Lesson 3.10 Networking Fundamentals
A device joining a network cannot talk to anyone until it has two things. This lesson works out what they are, then follows the two protocols that provide them, step by step.
Stage: Think
Joining a network
Think it through
You take your laptop to a friend’s house and join their Wi-Fi. Within seconds it can reach websites, yet you typed in no settings. What must the laptop have been given, and by whom?
- Hint 1: Could anything be sent to the laptop without an address of its own?
- Hint 2: How would it know the way out to the internet?
Show what happens
An address of its own on that network and a few settings to go with it, handed out automatically by a device on the network, usually the router. How that happens is the first half of this lesson.
Think it through
Show the answer
Answer: C. Ask the whole local network.
Ask everyone on the local network “who has this IP address?”, and let the owner answer. That question is the second half of the lesson.
Stage: Explain
Configuration first, local delivery next
Checking in to a hotel is a fair picture of joining a network. Reception gives you a room number for the length of your stay, tells you where the exit is and where to ask for directions. You did not choose the room, and when you leave it is given to someone else.
DHCP (Dynamic Host Configuration Protocol) is the reception desk. It gives a joining device an IP address for a limited time, called a lease, along with the other settings it needs.
Having a room number does not tell you where anyone else is. ARP (Address Resolution Protocol) is how a device finds out: it asks the local network “who has this IP address?” and gets back the MAC address to deliver to.
They solve different problems. DHCP gives a device its own settings. ARP finds a neighbour. Neither is DNS, which turns a name such as www.example.com into an IP address.
Check your understanding
Show the answer
Answer: B. ARP
ARP. DHCP gives a device its own settings, DNS turns names into addresses, and ARP finds a neighbour.
Where the hotel comparison stops. A hotel checks who you are before giving you a room. Ordinary DHCP does not: it gives an address to any device that asks.
Stage: Predict
A worked DHCP DORA exchange
A new laptop connects to a home LAN. In this example the router’s LAN interface is 192.168.1.1, and the router also provides DHCP and DNS forwarding. Combining these services on one device is common, but their roles remain distinct.
The laptop has no IP address yet, so it cannot be sent anything directly. The DHCP server has these settings to offer:
| Configuration | Illustrative value | What it enables |
|---|---|---|
| Client address | 192.168.1.10 | The laptop’s own address on this network: its room number |
| Subnet mask | 255.255.255.0 (/24) | Tells the laptop which addresses are on its own network |
| Default gateway | 192.168.1.1 | The router to send to for anything outside this network: the exit |
| DNS server | 192.168.1.1 | Where to ask for the address that goes with a name: directions |
| Lease duration | 24 hours in this example | How long the address is the laptop’s before it must renew |
Lease lengths vary from network to network; 24 hours is only an example.
Think it through
Show the answer
Answer: A. Send it to every device on the local network.
Send it to everyone on the local network, as a broadcast. The first message of the exchange below does exactly that.
The exchange has four messages, remembered by their initials as DORA.
A typical first IPv4 allocation on one subnet, message by message between the laptop and the DHCP server. The server confirms the lease only at the final message.
- Step 1: Laptop to DHCP server. Discover (broadcast)Is any DHCP server there? The laptop has no address and does not know where a server is, so it sends this to everyone on the local network.
- Step 2: DHCP server to Laptop. OfferOffer 192.168.1.10/24, gateway and DNS server 192.168.1.1, with the configured lease duration. Delivery may be broadcast or unicast.
- Step 3: Laptop to DHCP server. Request (broadcast)Yes please: I would like 192.168.1.10 from that server. It is broadcast so that any other server that made an offer knows it was not chosen.
- Step 4: DHCP server to Laptop. AcknowledgeConfirmed: 192.168.1.10 is yours for 24 hours. The laptop applies the address, mask, gateway and DNS server.
Think it through
Why not just two messages, a request and a reply? Look at the Offer and the Request: what could go wrong with only two?
- Hint 1: How many DHCP servers might hear the Discover?
Show what happens
More than one server may answer, and an offer is only a proposal. The laptop has to say which offer it accepts, so that the others can take theirs back, and the chosen server has to confirm. The four reasons follow.
Why the exchange needs four stages
Two messages would not be enough, and each of the four has a reason.
- Discover exists because the laptop does not know where a server is.
- Offer is a proposal, not yet a promise. More than one server may answer.
- Request says which offer the laptop is accepting, so that the other servers can take theirs back.
- Acknowledge is the server’s confirmation. Only now is the address the laptop’s to use.
The result. The laptop now has an address (192.168.1.10), knows which addresses are local (/24), knows the way out (192.168.1.1) and knows where to look up names. With those four settings it can talk to devices on its own network and, through the gateway, to the rest of the world. Without them it could do neither.
Check your understanding
Show the answer
Answer: B. Devices on its own network only.
Only devices on its own network: it has an address and knows which addresses are local, but not the way out.
DHCP messages travel in UDP. The client sends from port 68 to port 67, and the server replies from port 67 to port 68. These are port numbers in software, not sockets on a switch.
DHCP is an application-layer protocol, even though it is delivered by broadcast: how a message is delivered does not decide its layer.
Go deeper Broadcast or unicast, relays and renewals
- Which messages are broadcast. Discover and Request are normally broadcast during a first allocation. Offer and Acknowledge may be broadcast or sent to the laptop alone, depending on the device. Before it has an address, the laptop sends from
0.0.0.0to the broadcast address255.255.255.255. - Relays. Routers do not pass broadcasts on, so a DHCP server on another network would never hear a Discover. A DHCP relay on the local network picks the request up and forwards it to the server directly. That is a special arrangement for DHCP, not routers forwarding broadcasts in general, and the port numbers on relayed traffic follow their own rules.
- Renewals. DORA describes a first allocation. A device that already holds a lease renews it with a shorter exchange.
The DHCP specification sets all of this out.
Stage: Predict
ARP example A: send to a local printer
The laptop now has 192.168.1.10/24. A printer at 192.168.1.20/24 is on the same subnet and broadcast domain. Assume the laptop’s ARP cache does not already contain the printer’s mapping.
| Device | IPv4 address | Illustrative MAC |
|---|---|---|
| Laptop A | 192.168.1.10 | 02:00:00:00:00:10 |
| Printer B | 192.168.1.20 | 02:00:00:00:00:20 |
Think it through
The laptop wants to send to the printer at 192.168.1.20 for the first time. What will it need to ask, and who will hear the question?
- Hint 1: Does the laptop know where the printer is yet?
Show what happens
It needs the printer’s hardware address on this network, so it asks “who has 192.168.1.20?”, and every device on the local network hears the question. The steps below follow it.
Illustrative devices on one Ethernet subnet: A is 192.168.1.10 and B is 192.168.1.20. MAC addresses are locally administered examples.
- 1 · Broadcast requestA → All devices on the local link
Who has 192.168.1.20? Tell 192.168.1.10. Ethernet destination: ff:ff:ff:ff:ff:ff.
- 2 · Unicast replyB → A
192.168.1.20 is at 02:00:00:00:00:20. Reply addressed to A’s MAC: 02:00:00:00:00:10.
- 3 · Use the mappingA → B
A caches the IP-to-MAC mapping and sends frames to 02:00:00:00:00:20.
For a remote destination, A normally resolves its next-hop router’s MAC address. ARP resolves Layer 3 information for Layer 2 delivery; ordinary messages are not authenticated.
- The laptop compares addresses and sees that the printer is on its own network, so it will deliver directly. To do that it needs the printer’s MAC address, which it does not have.
- It asks “Who has 192.168.1.20?” in an ARP request. The Ethernet destination is
ff:ff:ff:ff:ff:ff, the broadcast address, so devices in the broadcast domain receive it. - The printer recognises its IP address and normally sends a unicast ARP reply to the laptop, reporting
02:00:00:00:00:20. - The laptop caches the mapping. It can now send a frame whose destination MAC is the printer’s MAC, carrying a packet whose destination IP is
192.168.1.20.
Think it through
Show the answer
Answer: B. No: it remembers the answer for a while.
No. It keeps the answer for a short time, as described next.
The laptop keeps the answer in its ARP cache, a short-lived list of IP addresses and the MAC addresses that go with them, so that it does not have to ask again for every packet. ARP only finds an address for local delivery. It does not open a connection or give permission to print. See the ARP specification.
Stage: Predict
ARP example B: send towards a remote web server
Think it through
An ARP request is heard only on the local network. So how can the laptop send a frame towards a server on another network?
- Hint 1: Which device on the home network leads to other networks?
Keep the same laptop but use remote server 198.51.100.20, a documentation-only address. The default gateway is 192.168.1.1, with illustrative MAC 02:00:00:00:00:01. The laptop compares addresses, sees that the server is not on its own network, and so sends the data to the gateway to pass on. The gateway is called the next hop: the next device on the way.
| Question | Answer for this remote connection |
|---|---|
| Which IPv4 address needs ARP resolution? | The next hop, 192.168.1.1 |
| What does the ARP request ask? | “Who has 192.168.1.1?” |
| Who normally replies? | The gateway’s local interface |
| Destination MAC on the outgoing local frame | 02:00:00:00:00:01 |
| Destination IP inside that frame | 198.51.100.20, the remote server |
The laptop does not broadcast an ARP request across the internet for the server’s MAC. The gateway receives the local frame and forwards the enclosed IP packet according to its routing information. Each link has its own delivery mechanism. The IP forwarding walkthrough follows the packet beyond this first hop.
Check your understanding
Show the answer
Answer: B. The server’s, 198.51.100.20.
The server’s, 198.51.100.20. The frame is addressed to the next hop; the packet inside keeps its real destination.
The same rule applies to a two-network example, where PC1 on 10.1.16.0/24 sends to PC2 on 10.1.15.0/24:
Illustrative: PC1 (10.1.16.1/24) sends to PC2 (10.1.15.8/24) through a router, with no NAT involved. The router’s interface IP and MAC addresses were not recorded, so they are described rather than given.
- 1 · Compare networksPC1: 10.1.15.8 is not in 10.1.16.0/24
The destination is off-link, so PC1 sends the packet to its next hop, normally its default gateway.
- 2 · ARP for the next-hop routerPC1 → Broadcast on the local 10.1.16.0/24 network
PC1 asks which device has the configured next-hop router’s IPv4 address: the router’s own address on this network. 10.1.16.0/24 names the network; it is not the router’s address. The reply gives the router’s MAC address, which PC1 needs instead of PC2’s.
- 3 · Frame to the routerDestination MAC: router’s MAC · Destination IP: 10.1.15.8
The Ethernet frame is addressed to the router’s MAC address. Because this example involves no NAT, the IP packet inside still carries PC2’s address, 10.1.15.8.
- 4 · Router repeats on the far sideRouter → ARP for 10.1.15.8 → PC2
The router forwards the packet into 10.1.15.0/24 in a new frame addressed to PC2’s MAC address.
Each ARP cache stores learned IPv4-to-MAC mappings for devices on its own link. IPv6 uses Neighbour Discovery instead of ARP.
Stage: Predict
ARP spoofing and defensive controls
Think it through
Any device can answer “who has 192.168.1.1?”, and the laptop believes the answer. What could a dishonest device on the network do with that?
- Hint 1: Does the laptop check who answered?
Show what happens
Answer with its own hardware address, so that the laptop sends its traffic for the gateway to the attacker instead.
Ordinary ARP messages are not authenticated. Forged information can associate an attacker’s MAC address with another device’s IPv4 address, potentially redirecting traffic. This is ARP spoofing or ARP poisoning; it differs from exhausting a switch’s MAC table through MAC flooding.
Three controls help.
- Checking ARP against DHCP. Some switches can watch the DHCP exchange and note which address was given to the device on which port (a feature called DHCP snooping). They can then drop any ARP message that claims an address its port was never given (Dynamic ARP Inspection). It works only if it is set up correctly, including for devices whose addresses were typed in by hand.
- Segmentation. ARP is local, so dividing the network into smaller parts limits how many devices one attacker can deceive.
- Encryption. HTTPS keeps the content of a redirected conversation unreadable. It does not stop the redirection.
None of these makes ARP itself trustworthy.
Stage: Explain
IPv4 and IPv6 are different
These DORA and ARP examples concern IPv4. IPv6 uses Neighbour Discovery, involving ICMPv6 and multicast, rather than ARP. Do not transfer the four-message IPv4 DORA sequence or the Ethernet broadcast example unchanged to IPv6 configuration and neighbour discovery.
arp -a on Windows, or ip -4 neigh on Linux, lists a device’s ARP cache. Seeing the gateway’s IP address paired with an unexpected MAC address, or two IP addresses sharing one MAC, can be a sign of ARP spoofing worth reporting. Inspecting Network Configuration covers these commands.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
- Hint 1: Look back at the special IPv4 addresses.
Show the answer
Answer: A. DHCP: no lease was given.
DHCP. With no answer to its Discover, the laptop gave itself a link-local address, so it has no usable settings.
Apply it
Show the answer
Answer: B. A possible ARP spoof, worth reporting.
It may be ARP spoofing: another device may be answering for the gateway. It is worth reporting rather than ignoring.
Apply it
Show the answer
Answer: B. It hides the content, not the route.
HTTPS keeps the content unreadable, but the traffic is still redirected through the attacker. Encryption and preventing the redirection are separate controls.
Stage: Check
Check your understanding
These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow.
Show answer
Answer: Discover → Offer → Request → Acknowledge
The client discovers servers, a server offers configuration, the client requests an offer and the server acknowledges the lease. The other DHCP orders put messages before their prerequisites; request/reply/cache describes ARP more closely.
Revision sources: Session 5: Networking Fundamentals — Part 1 (Classroom session record)
Show answer
Answer: It is an application-layer protocol.; It uses UDP port 67 at the server and 68 at the client.
DHCP is application-layer and uses UDP 67/68. Broadcast delivery does not determine its OSI layer. Initial Discover and Request are typically broadcast; Offer and Acknowledgement can be broadcast or unicast.
Revision sources: Session 5: Networking Fundamentals — Part 1 (Classroom session record)
Show answer
Answer: A DHCP relay agent
A DHCP relay carries DHCP communication between subnets. ARP resolves local link-layer addresses, NAT translates addressing, and TCP 443 is not the DHCP transport or port arrangement.
Revision sources: Session 5: Networking Fundamentals — Part 1 (Classroom session record)
Show answer
Answer: It broadcasts an ARP request and the owner normally replies by unicast.
Ordinary ARP uses a broadcast request and normally a unicast reply, allowing the sender to cache the mapping. It cannot initially address a unicast frame to a MAC it does not know. DNS resolves names and DHCP supplies IP configuration.
Revision sources: Session 5: Networking Fundamentals — Part 1 (Classroom session record)
Show answer
Answer: The next-hop router’s local MAC address
Local frame delivery targets the next hop, normally the router. The remote IP destination remains in the IP packet. ARP does not resolve a remote server’s MAC across routers, and MAC addresses are not calculated from public IPs or chosen by the DNS server.
Revision sources: Session 5: Networking Fundamentals — Part 1 (Classroom session record)
Study and revision
Return to What Is a Network? or use the Networking & Protocols topic for the DHCP and ARP questions and cards. They are learning-only.
Stage: Consolidate
What to remember
- DHCP gives a joining device its settings on a lease: address, mask, default gateway and DNS server.
- DORA is four messages: Discover, Offer, Request, Acknowledge; only the Acknowledge confirms the lease.
- ARP asks the local network “who has this IP address?” and caches the MAC address in the answer.
- For a remote destination, a device resolves its next hop, normally the default gateway; the server’s IP address stays in the packet.
- ARP is not authenticated, so it can be spoofed; IPv6 uses Neighbour Discovery instead.
Key terms
- DHCP (Dynamic Host Configuration Protocol)
An application-layer protocol that automatically provides IP configuration, such as an address, subnet mask, default gateway and DNS server information.
- ARP (Address Resolution Protocol)
A protocol that finds the MAC address for an IPv4 address on the local network, using a broadcast request and a normally unicast reply.
- ARP cache
A device’s store of recently learned IPv4-to-MAC address mappings, so it does not have to send an ARP request for every packet.
Common misunderstandings
It resolves the MAC address of its next hop, normally the default gateway. The server’s IP address stays in the packet.
DHCP grants a lease for a limited time, which the device renews while it stays on the network.
DHCP is an application-layer protocol. How a message is delivered does not decide its layer.
Lesson sources and acknowledgements
Sources and scope
These worked examples develop the additional educational explanations from my Session 5 ChatGPT note-taking discussion alongside the approved Learning Log. They are illustrative explanations, not verbatim tutor quotations or completed network configuration exercises. The MAC addresses in this lesson use locally administered unicast examples consistent with the existing learning diagrams.
- Taught in Session 5 (see the Session 5 Learning Log): DHCP and the DORA exchange, UDP ports 67 and 68, broadcast use and relay agents, ARP requests and replies, the ARP cache, remote destinations resolving the next-hop router, and ARP spoofing.
- From the Study Buddy session on 23 September: the IPv4 address, MAC address and ARP cache relationship, and the two-network example reused in the next-hop diagram.
- Supplementary explanation: the hotel-reception comparison, the worked DHCP and ARP scenarios, the “Go deeper” note, the plain descriptions of DHCP snooping and Dynamic ARP Inspection, the misunderstandings and the practical note.
Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the joining-a-network opening questions, every question asked in the lesson with its feedback and hints, the application questions and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
A protocol that finds the MAC address for an IPv4 address on the local network, using a broadcast request and a normally unicast reply.
A device’s store of recently learned IPv4-to-MAC address mappings, so it does not have to send an ARP request for every packet.
Communication sent to every device in the relevant broadcast domain. Routers do not normally forward ordinary local broadcasts.
The last address of an IPv4 subnet, with all host bits set to 1. Traffic sent to it reaches every device in that subnet.
The set of devices that receive one another’s local broadcasts. It is often bounded by a VLAN, and routers do not normally forward ordinary broadcasts between domains.
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
The next-hop router a device uses when no more specific route to a destination exists.
An application-layer protocol that automatically provides IP configuration, such as an address, subnet mask, default gateway and DNS server information.
The system that translates domain names into IP addresses. It commonly uses port 53 over UDP and TCP.
Transforming data with a cipher and a key so that it cannot be read without the right key. Decryption reverses it.
The standard way devices on a wired local network send data to each other, in units called frames that carry the MAC address of the sender and of the intended receiver.
The unit of data at the Data Link layer, such as an Ethernet frame. It is addressed with MAC addresses for delivery across one local link.
HTTP protected by TLS. HTTP/1.1 and HTTP/2 commonly use TCP port 443, while HTTP/3 uses QUIC over UDP port 443.
A logical network-layer address identifying an interface for delivery across networks. IPv4 addresses are 32 bits; IPv6 addresses are 128 bits.
A network covering a local area such as a home, office or building. Network scopes are general descriptions, not fixed distance limits.
A link-layer address used for local frame delivery, conventionally 48 bits written in hexadecimal. It may be randomised or spoofed, so it is not proof of identity.
Communication sent to a selected group of recipients.
The IPv6 mechanism, using ICMPv6 messages, that finds neighbouring devices and their link-layer addresses. It replaces ARP in IPv6.
The unit of data at the Network layer, such as an IP packet. It carries source and destination IP addresses between networks.
A 16-bit logical number that identifies a service or endpoint for TCP or UDP. It is different from a physical switch port.
An agreed set of rules for how data is formatted, transmitted and interpreted so that devices can communicate.
A device that forwards traffic between networks, for example between a private local network and the internet.
Dividing an environment into parts, with enforced rules about which communication is allowed between them.
A software endpoint for network communication, managed by the operating system.
One network within a larger set of networks: a group of IP addresses that share the same network part, so that devices in it can reach each other directly without a router.
A 32-bit value that marks which bits of an IPv4 address belong to the network (1s) and which belong to the host (0s), such as 255.255.255.0.
A device that connects devices within a local network and forwards Ethernet frames using the MAC addresses it has learned.
A connectionless transport protocol that sends datagrams without first establishing a connection or guaranteeing delivery.
Communication sent to one intended recipient.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.