DHCP glossary

What is DHCPDISCOVER?

DHCPDISCOVER is a DHCP message type that a client broadcasts to locate available DHCP servers on its local network. It is the first message in the DHCP exchange defined in RFC 2131, and servers that receive it can answer with a DHCPOFFER containing proposed configuration.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

DHCPDISCOVER is the initial broadcast message that DHCP clients send to locate available DHCP servers on their local network, as defined in RFC 2131, and forms the first step of the DORA (Discover, Offer, Request, Acknowledge) exchange. When a client boots or joins a network without a valid IP address, it broadcasts DHCPDISCOVER from source address 0.0.0.0 to the limited broadcast address 255.255.255.255 on UDP ports 68 to 67, allowing servers to respond with DHCPOFFER messages containing proposed IP configuration and lease terms. Failure to receive DHCPOFFER responses—caused by missing relay agents, exhausted address pools, server outages, or firewall filtering of DHCP ports—prevents devices from obtaining usable addresses and typically forces them to fall back to non-routable link-local addresses in the 169.254.0.0/16 range, which breaks network access and requires administrators to diagnose relay configuration, scope availability, and server health.

  • DHCPDISCOVER carries the client hardware address and transaction ID with optional parameters such as requested IP address, and because broadcasts do not cross routers, DHCP relay agents must forward the message as unicast to configured servers on other segments.
  • Unauthenticated DISCOVER broadcasts expose networks to rogue DHCP servers that can distribute false gateways or DNS servers; switch-based mitigations such as DHCP snooping restrict where server replies are accepted.
  • Large network deployments experience DISCOVER storms during power restoration, switch reboots, and office-wide Wi-Fi reconnects, requiring adequate server capacity and address pool sizing to handle peak message bursts.

DHCPDISCOVER at a glance

AttributeValue
Full nameDHCPDISCOVER
CategoryDHCP message type
Defined inRFC 2131, with message type values carried in options described in RFC 2132
Protocol and portUDP; client sends from port 68 to server port 67
OSI layerApplication layer (Layer 7)
Primary useLocating DHCP servers so a client can request an IP address lease
Related termsDHCP, DHCPOFFER, DHCPREQUEST, DHCPACK, DHCP relay agent, DHCP lease

How DHCPDISCOVER works

A client with no valid IP configuration, such as one that has just booted or joined a network, sends DHCPDISCOVER to find any DHCP server that can configure it. This is the first step of the exchange often called DORA.

  1. Client broadcasts DHCPDISCOVER: The client has no address, so it sends the message from source address 0.0.0.0 to the limited broadcast address 255.255.255.255, using UDP from port 68 to port 67.
  2. Message carries client identity and hints: The message includes the client hardware address and a transaction ID. It can also carry options, such as a requested IP address or a list of parameters the client wants.
  3. Relay agents forward if needed: Broadcasts do not cross routers. If no server is on the local segment, a DHCP relay agent forwards the message to configured servers as unicast.
  4. Servers respond with DHCPOFFER: Each server that can serve the client replies with a DHCPOFFER holding a proposed address and lease terms. The client then chooses an offer and sends a DHCPREQUEST.

DHCPDISCOVER does not assign anything. The client holds no address until the server confirms with a DHCPACK. A client may receive several offers or none, and it retransmits the DISCOVER with backoff if no server answers.

Why DHCPDISCOVER matters in enterprise networks

DHCPDISCOVER is the entry point for nearly every device that joins an IPv4 network. Laptops, phones, printers, IP phones and many IoT devices send it whenever they connect or their lease cannot be renewed. In large networks, bursts of DISCOVER messages occur after power restoration, switch reboots or office-wide Wi-Fi reconnects, so server capacity and scope sizing need to handle these peaks.

When DHCPDISCOVER goes unanswered, devices cannot get usable addresses. Common causes include a missing or misconfigured relay agent, an exhausted address pool, a server outage, or a switch or firewall filtering UDP ports 67 and 68. Clients that fail to get a lease may fall back to a link-local address in the 169.254.0.0/16 range, as described in RFC 3927, which usually breaks access to network resources.

DISCOVER messages are unauthenticated broadcasts, so any host on the segment can answer with an offer. A rogue DHCP server can hand out false gateways or DNS servers. Switch features such as DHCP snooping, which restrict where server replies are accepted, reduce this risk. Monitoring DISCOVER volume and response times also gives early warning of pool exhaustion and starvation attacks.

DHCPDISCOVER vs DHCPOFFER

DHCPDISCOVER is the client's broadcast request to find servers, while DHCPOFFER is a server's reply that proposes an address and configuration to that client. What is DHCPOFFER?

AttributeDHCPDISCOVERDHCPOFFER
SenderClientDHCP server
Position in exchangeFirst messageSecond message
PurposeLocate available serversPropose configuration to the client
Source address0.0.0.0 when the client has no addressServer address

DHCPDISCOVER vs DHCPREQUEST

DHCPDISCOVER searches for servers without committing to any, while DHCPREQUEST tells servers which offer the client accepts or asks to renew or confirm an existing address. What is DHCPREQUEST?

AttributeDHCPDISCOVERDHCPREQUEST
SenderClientClient
PurposeFind serversAccept an offer, renew or verify a lease
Position in exchangeFirst messageThird message in a new lease
Commits to a serverNoYes, when selecting an offer

Common DHCPDISCOVER issues

Clients on a VLAN with no DHCP server never get an answer because broadcasts do not cross routers. The fix is a relay agent, often called an IP helper, on the gateway interface pointing to the correct server.

The server receives DISCOVER messages but has no free addresses, so it sends no offer. Clients then time out or self-assign a 169.254.0.0/16 address. Long lease times on transient guest devices are a common cause.

DHCP snooping with an untrusted uplink port can drop server replies, so DISCOVER is seen but no offer reaches the client. Port security or access lists that block UDP ports 67 and 68 cause similar symptoms.

Mass reconnects after a power loss or switch reboot send many DISCOVER messages at once, which can overload a server or fill a relay's queue. Staggered startup and adequately sized servers reduce the impact.

An unauthorized DHCP server, such as a consumer router plugged into the LAN, can answer DISCOVER first. Clients receive wrong gateways or DNS servers. Packet captures showing offers from unexpected sources confirm it.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

DHCPDISCOVER FAQ

Related terms

Article

DORA process

The sequence of discover, offer, request, and acknowledge messages exchanged between client and server for DHCP.

Learn more
Article

DHCPOFFER

Sent by the server to the client in response to a DHCPDISCOVER to offer an IP address, lease time, and network configuration parameters.

Learn more
Article

DHCPREQUEST

Sent by the client to the server in response to a DHCPOFFER indicating which server the client has chosen to further interact with.

Learn more
Article

DHCPACK

Sent by the server to the client in response to a DHCPREQUEST indicating that the server acknowledges the request.

Learn more
Article

DHCP (Dynamic Host Configuration Protocol)

The standard mechanism to dynamically assign IP addresses within a network.

Learn more
Article

DHCPNACK

Sent by the server to the client in response to a DHCPREQUEST indicating that the server does not acknowledge the request.

Learn more
Article

IPv4 (Internet Protocol version 4)

The fourth version of Internet Protocol that uses 32-bit addresses to route most of today’s internet traffic; the global supply of IPv4 addresses is exhausted. Learn More

Learn more
Article

User Datagram Protocol (UDP)

An alternative protocol to TCP used primarily for establishing low-latency and loss-tolerating connections between applications on the internet.

Learn more
Browse the full glossary