DHCP glossary

What is DHCPDISCOVER?

DHCPDISCOVER is a DHCP message type that a client broadcasts to locate available DHCP servers on its local network. It is the first message in the DHCP exchange defined in RFC 2131, and servers that receive it can answer with a DHCPOFFER containing proposed configuration.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

DHCPDISCOVER is the initial broadcast message that DHCP clients send to locate available DHCP servers on their local network, as defined in RFC 2131, and forms the first step of the DORA (Discover, Offer, Request, Acknowledge) exchange. When a client boots or joins a network without a valid IP address, it broadcasts DHCPDISCOVER from source address 0.0.0.0 to the limited broadcast address 255.255.255.255 on UDP ports 68 to 67, allowing servers to respond with DHCPOFFER messages containing proposed IP configuration and lease terms. Failure to receive DHCPOFFER responses—caused by missing relay agents, exhausted address pools, server outages, or firewall filtering of DHCP ports—prevents devices from obtaining usable addresses and typically forces them to fall back to non-routable link-local addresses in the 169.254.0.0/16 range, which breaks network access and requires administrators to diagnose relay configuration, scope availability, and server health.

  • DHCPDISCOVER carries the client hardware address and transaction ID with optional parameters such as requested IP address, and because broadcasts do not cross routers, DHCP relay agents must forward the message as unicast to configured servers on other segments.
  • Unauthenticated DISCOVER broadcasts expose networks to rogue DHCP servers that can distribute false gateways or DNS servers; switch-based mitigations such as DHCP snooping restrict where server replies are accepted.
  • Large network deployments experience DISCOVER storms during power restoration, switch reboots, and office-wide Wi-Fi reconnects, requiring adequate server capacity and address pool sizing to handle peak message bursts.

DHCPDISCOVER at a glance

AttributeValue
Full nameDHCPDISCOVER
CategoryDHCP message type
Defined inRFC 2131, with message type values carried in options described in RFC 2132
Protocol and portUDP; client sends from port 68 to server port 67
OSI layerApplication layer (Layer 7)
Primary useLocating DHCP servers so a client can request an IP address lease
Related termsDHCP, DHCPOFFER, DHCPREQUEST, DHCPACK, DHCP relay agent, DHCP lease

How DHCPDISCOVER works

A client with no valid IP configuration, such as one that has just booted or joined a network, sends DHCPDISCOVER to find any DHCP server that can configure it. This is the first step of the exchange often called DORA.

  1. Client broadcasts DHCPDISCOVER: The client has no address, so it sends the message from source address 0.0.0.0 to the limited broadcast address 255.255.255.255, using UDP from port 68 to port 67.
  2. Message carries client identity and hints: The message includes the client hardware address and a transaction ID. It can also carry options, such as a requested IP address or a list of parameters the client wants.
  3. Relay agents forward if needed: Broadcasts do not cross routers. If no server is on the local segment, a DHCP relay agent forwards the message to configured servers as unicast.
  4. Servers respond with DHCPOFFER: Each server that can serve the client replies with a DHCPOFFER holding a proposed address and lease terms. The client then chooses an offer and sends a DHCPREQUEST.

DHCPDISCOVER does not assign anything. The client holds no address until the server confirms with a DHCPACK. A client may receive several offers or none, and it retransmits the DISCOVER with backoff if no server answers.

Why DHCPDISCOVER matters in enterprise networks

DHCPDISCOVER is the entry point for nearly every device that joins an IPv4 network. Laptops, phones, printers, IP phones and many IoT devices send it whenever they connect or their lease cannot be renewed. In large networks, bursts of DISCOVER messages occur after power restoration, switch reboots or office-wide Wi-Fi reconnects, so server capacity and scope sizing need to handle these peaks.

When DHCPDISCOVER goes unanswered, devices cannot get usable addresses. Common causes include a missing or misconfigured relay agent, an exhausted address pool, a server outage, or a switch or firewall filtering UDP ports 67 and 68. Clients that fail to get a lease may fall back to a link-local address in the 169.254.0.0/16 range, as described in RFC 3927, which usually breaks access to network resources.

DISCOVER messages are unauthenticated broadcasts, so any host on the segment can answer with an offer. A rogue DHCP server can hand out false gateways or DNS servers. Switch features such as DHCP snooping, which restrict where server replies are accepted, reduce this risk. Monitoring DISCOVER volume and response times also gives early warning of pool exhaustion and starvation attacks.

DHCPDISCOVER vs DHCPOFFER

DHCPDISCOVER is the client's broadcast request to find servers, while DHCPOFFER is a server's reply that proposes an address and configuration to that client. What is DHCPOFFER?

AttributeDHCPDISCOVERDHCPOFFER
SenderClientDHCP server
Position in exchangeFirst messageSecond message
PurposeLocate available serversPropose configuration to the client
Source address0.0.0.0 when the client has no addressServer address

DHCPDISCOVER vs DHCPREQUEST

DHCPDISCOVER searches for servers without committing to any, while DHCPREQUEST tells servers which offer the client accepts or asks to renew or confirm an existing address. What is DHCPREQUEST?

AttributeDHCPDISCOVERDHCPREQUEST
SenderClientClient
PurposeFind serversAccept an offer, renew or verify a lease
Position in exchangeFirst messageThird message in a new lease
Commits to a serverNoYes, when selecting an offer

Common DHCPDISCOVER issues

Clients on a VLAN with no DHCP server never get an answer because broadcasts do not cross routers. The fix is a relay agent, often called an IP helper, on the gateway interface pointing to the correct server.

The server receives DISCOVER messages but has no free addresses, so it sends no offer. Clients then time out or self-assign a 169.254.0.0/16 address. Long lease times on transient guest devices are a common cause.

DHCP snooping with an untrusted uplink port can drop server replies, so DISCOVER is seen but no offer reaches the client. Port security or access lists that block UDP ports 67 and 68 cause similar symptoms.

Mass reconnects after a power loss or switch reboot send many DISCOVER messages at once, which can overload a server or fill a relay's queue. Staggered startup and adequately sized servers reduce the impact.

An unauthorized DHCP server, such as a consumer router plugged into the LAN, can answer DISCOVER first. Clients receive wrong gateways or DNS servers. Packet captures showing offers from unexpected sources confirm it.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

DHCPDISCOVER FAQ

Related terms

Article

DORA process

The DORA process is the four-step sequence of Discover, Offer, Request, and Acknowledge messages exchanged between DHCP client and server to assign an IP address.

Learn more
Article

DHCPOFFER

DHCPOFFER is a message sent by a DHCP server to a client offering an IP address, lease duration, and network configuration parameters.

Learn more
Article

DHCPREQUEST

DHCPREQUEST is a message sent by a DHCP client to indicate which server’s offer it has accepted and to request the offered IP address.

Learn more
Article

DHCPACK

DHCPACK is a message sent by a DHCP server to a client to acknowledge the client’s request for an IP address and configuration parameters.

Learn more
Article

DHCP (Dynamic Host Configuration Protocol)

DHCP (Dynamic Host Configuration Protocol) is the standard mechanism to dynamically assign IP addresses within a network.

Learn more
Article

DHCPNACK

DHCPNACK is a message sent by a DHCP server to a client to indicate that the server does not acknowledge or cannot fulfill the client’s request.

Learn more
Article

IPv4 (Internet Protocol version 4)

Internet Protocol version 4 (IPv4) is the fourth version of Internet Protocol using 32-bit addresses to route most current internet traffic; its global supply is exhausted.

Learn more
Article

User Datagram Protocol (UDP)

UDP (user datagram protocol) is a protocol used for establishing low-latency and loss-tolerating connections between applications on the internet.

Learn more
Browse the full glossary