This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

DHCP - Packets confusion - Broadcast vs Unicast

1
1

Hello,

Was checking out the DHCP packet capture on Wireshark-

alt text

It is evident that only the 1st packet has dest IP addr. 255.255.255.255 i.e. is broadcast and rest 3 packets are unicast. But the Microsoft article on DHCP mentions that all 4 packet are broadcast- alt text

Kindly advise.

Thanks,

Rahil

asked 04 Apr '15, 05:44

Rahil's gravatar image

Rahil
16122
accept rate: 0%

edited 04 Apr '15, 08:14

grahamb's gravatar image

grahamb ♦
19.8k330206


One Answer:

2

See RFC 2131. The MS KB article you link to only really covers RFC 1541 which was superseded by 2131, and also only covers up to Win 95 and NT 4.0, so is really old.

The first message (DHCP Discover) is a broadcast as the client doesn't know where the DHCP servers are (or if there are any around).

The second message (DHCP Offer) is unicast to the IP address that the DHPC server is offering. This is as per the RFC where the client did not set the broadcast bit in the DHCP Discover message.

The third message (DHCP Request) is broadcast by the client as it is SELECTing the offer, other DHPC servers on the subnet need to know which offer has been selected.

The fourth message (DHCP Ack) is unicast by the server to the client at the IP address the client requested.

answered 04 Apr '15, 08:13

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%