A live Wireshark capture demonstrates the complete DHCPv4 four-step handshake and DHCPv6 exchange, showing exactly how IP address assignment works at the packet level.
DHCP Process in Wireshark
The DHCP packets start traversing this network as soon as you plug in the device. So what I'm going to do is pull up Wireshark and monitor. What I've got is the Ethernet plug unplugged from the device. I'm going to monitor the Ethernet, and then I'm going to plug this in and see what we capture.
All right, I plugged this machine back in. It generated a lot of packets, and then I've stopped the capture. So I look through here, and what we're looking for are these DHCP ones — the one with the protocol that says DHCP, and that's associated with IP version 4. I can see that this is a DHCP request right here. Let's go ahead and just sort by this protocol, so we group them all together.
We can see it actually makes several requests, and it's not until we get down to this discovery where we actually see that process that I've been talking about, where there is a discovery, then there's an offer, then a request, and then an acknowledgement. These other ones, it looks like to me that it's asking for that same IP address, and for some reason the server is not responding back.
And so then we get to this discovery right here. Now it's making a call out, and this is what lines up with what we've been talking about. I see the source is 0.0.0.0, so that means it's just unspecified. It doesn't know an IP address; it doesn't have an IP address yet. So that makes sense. And then the destination is 255.255.255.255, so that is a broadcast. It's going out to all the devices on the network, looking for that DHCP server.
I can open up the layer 2 and I see that the layer 2 is all Fs, so that lines up with that broadcast. It lines up with what we saw with the IP address. And then we see the source is the MAC address of the Dell machine — that's the demo laptop — and so that lines up as well. I mean, it knows its own MAC address, so why not use its own MAC address? And we see that the source port is 68 and the destination port is 67. All things that we talked about before.
We get a response back from the demo Pi. Its IP address is 10.1.0.3, and we can see the MAC address in there is the demo Pi's MAC address, so that makes sense. And it's going directly to 10.1.0.150. It's offering that out, and it's going to the destination of the Dell, saying this is an IP address that's available to you. And of course we've got the source port of 67 and destination port of 68.
Then we click on the request, and the request is once again being sent from 0.0.0.0 and being broadcast out to all the other devices, so that if there were multiple offers, then all of those DHCP servers would know that it's accepted this particular one. We see that the destination layer 2 is a broadcast, all Fs — that makes sense — and the MAC address is of the machine, so that makes sense. And source port 68, destination port of 67. So all of that lines up. It's just toggling between those two different ports.
And then we get down to the DHCP acknowledgement. The DHCP acknowledgement is being sent from the demo Pi, and it's being sent directly to the demo laptop, and it's using, from a layer 2 perspective, those MAC addresses. And once again, source port is 67 and destination port is 68. Then within the DHCP options down here below, we see the information that addresses things like lease time and the subnet. We see subnet mask in here, and the DHCP identifier — that's the server that it's coming from. So we see all of that information that's being sent out within the payload of this DHCP notification there.
It's a four-step process of being sent back and forth to get this DHCP address.
Let's also take a quick glance at DHCP version 6. We scroll down, and it looks like there's some similar activity that's happening. We'll jump to this one right here, which is going from the Dell machine. I know it's the Dell machine because the source MAC address is the MAC address of the Dell machine, so we see that right there. And it's going to the destination of this multicast address, so we see the multicast address in both the layer 2 and the layer 3. So the multicast address here, and it's coming from the layer 3 link local address. We see the layer 3 link local address of the demo laptop.
And it is then getting responded back to here in this packet 182, and in that one it's coming from the link local address of the demo Pi and going to the link local address of the demo laptop. And if we look at the layer 2 once again, we see the source MAC address of the demo Pi and the destination MAC address of the demo laptop.
And then we see a reply back coming from the demo laptop to the demo Pi. That is coming from the link local address of the demo laptop and going to the broadcast address — excuse me, not the broadcast but the multicast address, just like before. And then we see a reply back from the demo Pi, coming from the link local address of the demo Pi and going to the link local address of the demo laptop. So it's a very similar back and forth as we saw with DHCP.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →