UDP Checksum UDP Length

Source Port = 68 (bootpc) Destination Port = 67 (bootps)

TTL Header Checksum
Identification Flags Fragment Offset
Ver = 4 IHL = 5 TOS Total Length
Protocol=17(UDP)
Source IP Address = 0.0.0.0
Destination IP Address = 255.255.255.255
Source MAC Address = PC MAC Address (m1)
Destination MAC Address = FF:FF:FF:FF:FF:FF (Broadcast)
EtherType = 0x0800 (IP)
Transaction ID (xid)
Seconds Broadcast Flag (1b)
Client IP address (ciaddr) = 0.0.0.0
Your IP Address (yiaddr) = 0.0.0.0
Server IP address (siaddr) = 0.0.0.0
Gateway IP Address (giaddr) = 0.0.0.0
0B 4B 2B
OP code=1(Req.) HW Type=Ethernet HW Length = 6 HOPS
Client Hardware Address (16B) (chaddr) = PC MAC Address (m1)
Server Name (64B) (sname)
Filename (128B)
E
t
h
e
r
n
e
t
I
P
U
D
P
D
H
C
P

M
e
s
s
a
g
e

P
a
y
l
o
a
d
DHCP Message Type (Option 53) = 1 (DHCP Discover)
Parameter Request List (Option 55) = Option 1, 3, 6, ...
Client Identifier (Option 51) = PC MAC Address (m1)
DHCP Discover
Ethernet Header {DA=FF:FF:FF:FF:FF:FF, SA=m1},
IP Header {SIP=0.0.0.0, DIP=255.255.255.255},
DHCP Payload {Client MAC=m1}
DHCP Offer
Ethernet Header {DA=FF:FF:FF:FF:FF:FF, SA=m2},
IP Header {SIP=1.1.1.254, DIP=255.255.255.255},
DHCP Payload {Your IP=1.1.1.10, Client MAC=m1,
Subnet Mask(1)=255.255.255.0, Router(3)=1.1.1.1,
DNS(6)=10.1.1.1 & 10.1.1.2, IP Lease Time(51)=3,600s,
DHCP Server Identifier(54)=1.1.1.254}
DHCP Request
Ethernet Header {DA=FF:FF:FF:FF:FF:FF, SA=m1},
IP Header {SIP=0.0.0.0, DIP=255.255.255.255},
DHCP Payload {Client MAC=m1, Requested IP
Address(50)=1.1.1.10,
DHCP Server Identifier(54)=1.1.1.254}
DHCP Ack
Ethernet Header {DA=FF:FF:FF:FF:FF:FF, SA=m2},
IP Header {SIP=1.1.1.254, DIP=255.255.255.255},
DHCP Payload {Your IP=1.1.1.10, Client MAC=m1,
Subnet Mask(1)=255.255.255.0, Router(3)=1.1.1.1,
DNS(6)=10.1.1.1 & 10.1.1.2, IP Lease Time(51)=3,600s,
DHCP Server Identifier(54)=1.1.1.254}
PC DHCP
DHCP message format: DHCP DISCOVER Message
www.netmanias.com Netmanias ONE-SHOT
Ethernet Header
o Destination MAC Address: As the client is NOT aware of a MAC address of DHCP server, it floods DHCP DISCOVER message on the
Ethernet network using Broadcast MAC address (0xFFFFFFFFFFFF)
o Source MAC Address: The source MAC address on the Ethernet is always an address of the sender of the packet. Thus, this field is
the MAC address of the client (m1).
o EtherType: This field indicates that the header is followed by an IP packet (IP=0x0800, ARP=0x0806, etc)
IP Header
o Protocol ID: This field indicates that the header is followed by UDP packet (UDP=17, TCP=6, etc)
o Source IP Address: This field is set to 0.0.0.0 because no IP address is allocated to the client
o Destination IP Address: The client is NOT aware of an IP address of DHCP server so it floods DHCP DISCOVER message over the IP
network using Broadcast IP address (255.255.255.255)
UDP Header
o Source Port: This field indicates that the DHCP message sender is the DHCP client (68=BOOTP Client), so the client always sends the
message with Source Port=68
o Destination Port: This field indicates that the DHCP message receiver is the DHCP server (67=BOOTP Server), so the server always
sends the message with Destination Port=67
DHCP Message Payload
o Client MAC Address (chaddr): This field is the MAC address of the client (m1)
o DHCP Message Type (Option 53): This field indicates that DHCP message type is DHCP DISCOVER (Value=1)
o Client Identifier (Option 51): This field acts as an indicator to discriminate clients, and generally contains the MAC address of the
client (m1). Then, DHCP server discriminates individual clients.
o Parameter Request List (Option 55): This field contains the network information list (DHCP Option List) that the client needs to
request from DHCP Server. For example, it request Subnet Mask, Default GW IP address, DNS IP address and so on.
DHCP message format: DHCP OFFER Message
www.netmanias.com Netmanias ONE-SHOT
Ethernet Header
o Destination MAC Address: The DHCP server broadcasts DHCP OFFER message over the Ethernet network
o Source MAC Address: The source MAC address on the Ethernet is always an address of the sender of the packet. Thus, this field is
the MAC address of the client (m2)
IP Header
o Source IP Address: This field is the IP address of DHCP server (1.1.1.254)
o Destination IP Address: As the client is NOT aware of an IP address of DHCP server, it floods DHCP DISCOVER message over the IP
network using Broadcast IP address (255.255.255.255)
UDP Header
o Source Port: This field indicates that the DHCP message sender is the DHCP server, so the server always sends the message with
Source Port=67
o Destination Port: This field indicates that the DHCP message receiver is the DHCP client, so the client always sends the message with
Destination Port=68
DHCP Message Payload
o Your IP Address (yiaddr): This field is the IP address to be used by the client (1.1.1.10)
o Client MAC Address (chaddr): This field is the MAC address of the client (m1)
o DHCP Message Type (Option 53): This field indicates that DHCP message type is DHCP OFFER (Value=2)
o Subnet Mask (Option 1): This field is the Subnet Mask to be used by the client (255.255.255.0 (/24))
o Router IP (Option 3): This field is the IP address (1.1.1.1) of the Default Gateway (the first router or L3 switch seen by the client to
get to the Internet) to be used by the client
o Domain Name Server IP (Option 6): This field is the IP address of DNS server to be used by the client. Normally, it provides two IP
addresses as Primary DNS IP address (10.1.1.1) and Secondary DNS IP address (10.1.1.2) together
o IP Address Lease Time (Option 51): This field is the Lease Time during which the client is allowed to use the IP address allocated by
DHCP Server (3,600sec. (1hour)). At the mid-point of the Lease Time (30 minutes), the client starts its IP address renewal procedure.
o DHCP Server Identifier (Option 54): This field is the IP address of the DHCP server that sent the DHCP OFFER message (1.1.1.254). In
case that multiple DHCP servers on the same subnet sends DHCP OFFER message to the client, the client discriminates the server by
the field.
D
H
C
P

M
e
s
s
a
g
e

P
a
y
l
o
a
d
UDP Checksum UDP Length
Source Port = 67 (bootps) Destination Port = 68 (bootpc)
TTL Header Checksum
Identification Flags Fragment Offset
Ver = 4 IHL = 5 TOS Total Length
Protocol=17(UDP)
Source IP Address = DHCP Server IP Address (1.1.1.254)
Destination IP Address = 255.255.255.255
Source MAC Address = DHCP Server MAC Address (m2)
Destination MAC Address = FF:FF:FF:FF:FF:FF (Broadcast)
EtherType = 0x0800 (IP)
Transaction ID (xid)
Seconds Broadcast Flag (1b)
Client IP address (ciaddr) = 0.0.0.0
Your IP Address (yiaddr) = 1.1.1.10
Server IP address (siaddr) = 0.0.0.0
Gateway IP Address (giaddr) = 0.0.0.0
0B 4B 2B
OP code=2(Reply) HW Type=Ethernet HW Length = 6 HOPS
E
t
h
e
r
n
e
t
I
P
U
D
P
DHCP Discover
Ethernet Header {DA=FF:FF:FF:FF:FF:FF, SA=m1},
IP Header {SIP=0.0.0.0, DIP=255.255.255.255},
DHCP Payload {Client MAC=m1}
DHCP Offer
Ethernet Header {DA=FF:FF:FF:FF:FF:FF, SA=m2},
IP Header {SIP=1.1.1.254, DIP=255.255.255.255},
DHCP Payload {Your IP=1.1.1.10, Client MAC=m1,
Subnet Mask(1)=255.255.255.0, Router(3)=1.1.1.1,
DNS(6)=10.1.1.1 & 10.1.1.2, IP Lease Time(51)=3,600s,
DHCP Server Identifier(54)=1.1.1.254}
DHCP Request
Ethernet Header {DA=FF:FF:FF:FF:FF:FF, SA=m1},
IP Header {SIP=0.0.0.0, DIP=255.255.255.255},
DHCP Payload {Client MAC=m1, Requested IP
Address(50)=1.1.1.10,
DHCP Server Identifier(54)=1.1.1.254}
DHCP Ack
Ethernet Header {DA=FF:FF:FF:FF:FF:FF, SA=m2},
IP Header {SIP=1.1.1.254, DIP=255.255.255.255},
DHCP Payload {Your IP=1.1.1.10, Client MAC=m1,
Subnet Mask(1)=255.255.255.0, Router(3)=1.1.1.1,
DNS(6)=10.1.1.1 & 10.1.1.2, IP Lease Time(51)=3,600s,
DHCP Server Identifier(54)=1.1.1.254}
PC DHCP
Client Hardware Address (16B) (chaddr) = PC MAC Address (m1)
Server Name (64B) (sname)
Filename (128B)
Subnet Mask (Option 1) = 255.255.255.0 (/24)
Router IP (Option 3) = 1.1.1.1
Domain Name Server IP (Option 6) = 10.1.1.1, 10.1.1.2
IP Address Lease Time (Option 51) = 3,600 seconds (1 hour)
DHCP Server Identifier (Option 54) = 1.1.1.254
DHCP Message Type (Option 53) = 2 (DHCP Offer)
DHCP message format: DHCP REQUEST Message
www.netmanias.com Netmanias ONE-SHOT
Ethernet Header
o Destination MAC Address: As the client is NOT aware of a MAC address of DHCP server, it floods DHCP REQUEST message over the
Ethernet network using Broadcast MAC address (0xFFFFFFFFFFFF) in order to inform all the DHCP servers of which DHCP server is
selected by the client.
o Source MAC Address: The source MAC address on the Ethernet is always an address of the sender of the packet. Thus, this field is
the MAC address of the client (m1)
IP Header
o Source IP Address: This field is set to 0.0.0.0 because no IP address is allocated to the client
o Destination IP Address: It floods DHCP REQUEST message over the IP network using Broadcast IP address (255.255.255.255) in order
to deliver the DHCP REQEUST message to all the DHCP servers on the same subnet
UDP Header
o Source Port: This field indicates that the DHCP message sender is the DHCP client (68=BOOTP Client)
o Destination Port: This field indicates that the DHCP message receiver is the DHCP server (67=BOOTP Server)
DHCP Message Payload
o Client MAC Address (chaddr): This field is the MAC address of the client (m1)
o DHCP Message Type (Option 53): This field indicates that DHCP message type is DHCP REQUEST (Value=3)
o Client Identifier (Option 51): This field acts as an indicator to discriminate clients, and generally contains the MAC address of the
client (m1). Then, DHCP server discriminates individual clients.
o Requested IP Address (Option 50): This field is the IP address (yiaddr=1.1.1.10) received through the DHCP OFFER message from
DHCP serve. This is intended to re-send the IP address to the DHCP server in order to verify if the IP address is valid. (In normal
operation, the DHCP server allocates the IP address to the client through the DHCP ACK message).
o Parameter Request List (Option 55): This field contains the network information list (DHCP Option List) that the client needs to
request from DHCP Server. For example, it request Subnet Mask, Default GW IP address, DNS IP address and so on.
UDP Checksum UDP Length
Source Port = 68 (bootpc) Destination Port = 67 (bootps)
TTL Header Checksum
Identification Flags Fragment Offset
Ver = 4 IHL = 5 TOS Total Length
Protocol=17(UDP)
Source IP Address = 0.0.0.0
Destination IP Address = 255.255.255.255
Source MAC Address = PC MAC Address (m1)
Destination MAC Address = FF:FF:FF:FF:FF:FF (Broadcast)
EtherType = 0x0800 (IP)
Transaction ID (xid)
Seconds Broadcast Flag (1b)
Client IP address (ciaddr) = 0.0.0.0
Your IP Address (yiaddr) = 0.0.0.0
Server IP address (siaddr) = 0.0.0.0
Gateway IP Address (giaddr) = 0.0.0.0
0B 4B 2B
OP code=1(Req.) HW Type=Ethernet HW Length = 6 HOPS
E
t
h
e
r
n
e
t
I
P
U
D
P
D
H
C
P

M
e
s
s
a
g
e

P
a
y
l
o
a
d
DHCP Discover
Ethernet Header {DA=FF:FF:FF:FF:FF:FF, SA=m1},
IP Header {SIP=0.0.0.0, DIP=255.255.255.255},
DHCP Payload {Client MAC=m1}
DHCP Offer
Ethernet Header {DA=FF:FF:FF:FF:FF:FF, SA=m2},
IP Header {SIP=1.1.1.254, DIP=255.255.255.255},
DHCP Payload {Your IP=1.1.1.10, Client MAC=m1,
Subnet Mask(1)=255.255.255.0, Router(3)=1.1.1.1,
DNS(6)=10.1.1.1 & 10.1.1.2, IP Lease Time(51)=3,600s,
DHCP Server Identifier(54)=1.1.1.254}
DHCP Request
Ethernet Header {DA=FF:FF:FF:FF:FF:FF, SA=m1},
IP Header {SIP=0.0.0.0, DIP=255.255.255.255},
DHCP Payload {Client MAC=m1, Requested IP
Address(50)=1.1.1.10,
DHCP Server Identifier(54)=1.1.1.254}
DHCP Ack
Ethernet Header {DA=FF:FF:FF:FF:FF:FF, SA=m2},
IP Header {SIP=1.1.1.254, DIP=255.255.255.255},
DHCP Payload {Your IP=1.1.1.10, Client MAC=m1,
Subnet Mask(1)=255.255.255.0, Router(3)=1.1.1.1,
DNS(6)=10.1.1.1 & 10.1.1.2, IP Lease Time(51)=3,600s,
DHCP Server Identifier(54)=1.1.1.254}
PC DHCP
Client Hardware Address (16B) (chaddr) = PC MAC Address (m1)
Server Name (64B) (sname)
Filename (128B)
Requested IP Address (Option 50) = 1.1.1.10
DHCP Message Type (Option 53) = 3 (DHCP Request)
Parameter Request List (Option 55) = Option 1, 3, 6, ...
DHCP Server Identifier (Option 54) = 1.1.1.254
Client Identifier (Option 51) = PC MAC Address (m1)
DHCP message format: DHCP ACK Message
www.netmanias.com Netmanias ONE-SHOT
Ethernet Header
o Destination MAC Address: The DHCP server broadcasts DHCP ACK message over the Ethernet network in order to send to the client
o Source MAC Address: The source MAC address on the Ethernet is always an address of the sender of the packet. Thus, this field is
the MAC address of the DHCP server (m2)
IP Header
o Source IP Address: This field is the IP address of DHCP server (1.1.1.254)
o Destination IP Address: As the client is NOT aware of an IP address of DHCP server, it floods DHCP DISCOVER message over the IP
network using Broadcast IP address (255.255.255.255)
UDP Header
o Source Port: This field indicates that the DHCP message sender is the DHCP server, so the server always sends the message with
Source Port=67
o Destination Port: This field indicates that the DHCP message receiver is the DHCP client, so the client always sends the message with
Destination Port=68
DHCP Message Payload
o Your IP Address (yiaddr): This field is the IP address to be used by the client (1.1.1.10)
o Client MAC Address (chaddr): This field is the MAC address of the client (m1)
o DHCP Message Type (Option 53): This field indicates that DHCP message type is DHCP ACK (Value=5)
o Subnet Mask (Option 1): This field is the Subnet Mask to be used by the client (255.255.255.0 (/24))
o Router IP (Option 3): This field is the IP address (1.1.1.1) of the Default Gateway (the first router or L3 switch seen by the client to
get to the Internet) to be used by the client
o Domain Name Server IP (Option 6): This field is the IP address of DNS server to be used by the client. Normally, it provides two IP
addresses as Primary DNS IP address (10.1.1.1) and Secondary DNS IP address (10.1.1.2) together.
o IP Address Lease Time (Option 51): This field is the Lease Time during which the client is allowed to use the IP address allocated by
DHCP server (3,600sec. (=1hour)). In the middle of the Lease Time (30 minutes), the client starts its IP address renewal procedure.
o DHCP Server Identifier(Option 54): This field is the IP address of the DHCP server that sent the DHCP OFFER message (1.1.1.254). In
case that multiple DHCP servers on the same subnet sends DHCP OFFER message to the client, the client discriminates the server by
the field.
UDP Checksum UDP Length
Source Port = 67 (bootps) Destination Port = 68 (bootpc)
TTL Header Checksum
Identification Flags Fragment Offset
Ver = 4 IHL = 5 TOS Total Length
Protocol=17(UDP)
Source IP Address = DHCP Server IP Address (1.1.1.254)
Destination IP Address = 255.255.255.255
Source MAC Address = DHCP Server MAC Address (m2)
Destination MAC Address = FF:FF:FF:FF:FF:FF (Broadcast)
EtherType = 0x0800 (IP)
Transaction ID (xid)
Seconds Broadcast Flag (1b)
Client IP address (ciaddr) = 0.0.0.0
Your IP Address (yiaddr) = 1.1.1.10
Server IP address (siaddr) = 0.0.0.0
Gateway IP Address (giaddr) = 0.0.0.0
0B 4B 2B
OP code=2(Reply) HW Type=Ethernet HW Length = 6 HOPS
E
t
h
e
r
n
e
t
I
P
U
D
P
D
H
C
P

M
e
s
s
a
g
e

P
a
y
l
o
a
d
DHCP Discover
Ethernet Header {DA=FF:FF:FF:FF:FF:FF, SA=m1},
IP Header {SIP=0.0.0.0, DIP=255.255.255.255},
DHCP Payload {Client MAC=m1}
DHCP Offer
Ethernet Header {DA=FF:FF:FF:FF:FF:FF, SA=m2},
IP Header {SIP=1.1.1.254, DIP=255.255.255.255},
DHCP Payload {Your IP=1.1.1.10, Client MAC=m1,
Subnet Mask(1)=255.255.255.0, Router(3)=1.1.1.1,
DNS(6)=10.1.1.1 & 10.1.1.2, IP Lease Time(51)=3,600s,
DHCP Server Identifier(54)=1.1.1.254}
DHCP Request
Ethernet Header {DA=FF:FF:FF:FF:FF:FF, SA=m1},
IP Header {SIP=0.0.0.0, DIP=255.255.255.255},
DHCP Payload {Client MAC=m1, Requested IP
Address(50)=1.1.1.10,
DHCP Server Identifier(54)=1.1.1.254}
DHCP Ack
Ethernet Header {DA=FF:FF:FF:FF:FF:FF, SA=m2},
IP Header {SIP=1.1.1.254, DIP=255.255.255.255},
DHCP Payload {Your IP=1.1.1.10, Client MAC=m1,
Subnet Mask(1)=255.255.255.0, Router(3)=1.1.1.1,
DNS(6)=10.1.1.1 & 10.1.1.2, IP Lease Time(51)=3,600s,
DHCP Server Identifier(54)=1.1.1.254}
PC DHCP
Client Hardware Address (16B) (chaddr) = PC MAC Address (m1)
Server Name (64B) (sname)
Filename (128B)
Subnet Mask (Option 1) = 255.255.255.0 (/24)
Router IP (Option 3) = 1.1.1.1
Domain Name Server IP (Option 6) = 10.1.1.1, 10.1.1.2
IP Address Lease Time (Option 51) = 3,600 seconds (1 hour)
DHCP Server Identifier (Option 54) = 1.1.1.254
DHCP Message Type (Option 53) = 5 (DHCP Ack)