Hello, Was checking out the DHCP packet capture on Wireshark-
It is evident that only the 1st packet has dest IP addr. 255.255.255.255 i.e. is broadcast and rest 3 packets are unicast. But the Microsoft article on DHCP mentions that all 4 packet are broadcast- Kindly advise. Thanks, Rahil asked 04 Apr '15, 05:44  Rahil edited 04 Apr '15, 08:14  grahamb ♦ |
One Answer:
See RFC 2131. The MS KB article you link to only really covers RFC 1541 which was superseded by 2131, and also only covers up to Win 95 and NT 4.0, so is really old. The first message (DHCP Discover) is a broadcast as the client doesn't know where the DHCP servers are (or if there are any around). The second message (DHCP Offer) is unicast to the IP address that the DHPC server is offering. This is as per the RFC where the client did not set the broadcast bit in the DHCP Discover message. The third message (DHCP Request) is broadcast by the client as it is SELECTing the offer, other DHPC servers on the subnet need to know which offer has been selected. The fourth message (DHCP Ack) is unicast by the server to the client at the IP address the client requested. answered 04 Apr '15, 08:13 grahamb ♦ |
