5.3.1. DORA Process
💡 First Principle: A device joining a network has no IP address yet—so how does it ask for one? It shouts (broadcasts). DHCP uses a four-step handshake called DORA because neither side knows the other's address at the start. Each step narrows down the conversation from "anyone out there?" to a confirmed lease.
Why is the Request a broadcast? Because the client might receive Offers from multiple DHCP servers. The broadcast Request tells ALL servers which offer was accepted—so the others can reclaim their offered addresses.
Lease lifecycle: Once a client has a lease, it doesn't go through full DORA again. At 50% lease time, the client sends a unicast Request directly to the server to renew. If renewal fails, at 87.5% it broadcasts a Request to any available server. If the lease expires completely, the client starts over with Discover.
Key ports: DHCP server listens on UDP 67, client sends from UDP 68.
What the Offer carries: a complete proposed configuration. Besides the address being offered (the yiaddr field), it includes the lease time and the offering server's identifier, plus options such as the subnet mask, default gateway and DNS servers. The client compares Offers and names the one it accepts in its Request.
When the address is already taken: before using an acknowledged address the client checks that it is free (with ARP). If another host answers, the client sends DHCPDECLINE; the server marks the address as a conflict and stops handing it out, and the client starts again with a new Discover.
Server-side verification: show ip dhcp binding lists the server's leases. Type Automatic is a normal pool lease with an expiry time. Type Manual is a manual binding (a reservation tying one address to one client identifier or MAC), and it normally shows an Infinite lease.
⚠️ Exam Trap: The Discover and Request messages are always broadcast (even though the client already knows the server's IP after the Offer). The Offer and Acknowledge are typically unicast to the client's MAC address.
