This is our old Q&A Site. Please post any new questions and answers at


Was checking out the DHCP packet capture on Wireshark-

alt text

It is evident that only the 1st packet has dest IP addr. i.e. is broadcast and rest 3 packets are unicast. But the Microsoft article on DHCP mentions that all 4 packet are broadcast- alt text

Kindly advise.



asked 04 Apr '15, 05:44

Rahil's gravatar image

accept rate: 0%

edited 04 Apr '15, 08:14

grahamb's gravatar image

grahamb ♦

See RFC 2131. The MS KB article you link to only really covers RFC 1541 which was superseded by 2131, and also only covers up to Win 95 and NT 4.0, so is really old.

The first message (DHCP Discover) is a broadcast as the client doesn't know where the DHCP servers are (or if there are any around).

The second message (DHCP Offer) is unicast to the IP address that the DHPC server is offering. This is as per the RFC where the client did not set the broadcast bit in the DHCP Discover message.

The third message (DHCP Request) is broadcast by the client as it is SELECTing the offer, other DHPC servers on the subnet need to know which offer has been selected.

The fourth message (DHCP Ack) is unicast by the server to the client at the IP address the client requested.

permanent link

answered 04 Apr '15, 08:13

grahamb's gravatar image

grahamb ♦
accept rate: 22%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 04 Apr '15, 05:44

question was seen: 13,657 times

last updated: 04 Apr '15, 08:14

p​o​w​e​r​e​d by O​S​Q​A