TechKnowSurge
CompTIA Network+ 3.4 Cisco CCNA 4.3 Cisco CCST Networking 5.2 Cisco CyberOps Associate 4.8 Cisco CCNA 1.9 Cisco CCST Networking 1.5
VideoNetworkFree

DEMO: DHCP, Wireshark

A live Wireshark capture demonstrates the complete DHCPv4 four-step handshake and DHCPv6 exchange, showing exactly how IP address assignment works at the packet level.

Complete this video to capture a CTF flag worth 1 point.

About this video

The DHCP address assignment process is examined through a live Wireshark packet capture, taken the moment a device connects to a network. The DHCPv4 exchange unfolds across four distinct packets: a Discover broadcast sent from 0.0.0.0 to 255.255.255.255, an Offer from the DHCP server proposing an available address, a Request broadcast back to the network confirming acceptance, and a final Acknowledgement from the server that includes configuration details such as lease time, subnet mask, and server identifier. Throughout each step, the capture reveals how source and destination IP addresses, Layer 2 MAC addresses, and UDP ports 67 and 68 behave in accordance with the protocol specification. The capture also surfaces a practical detail often seen in real environments: the client first attempts to reclaim its previous IP address before the full Discover process begins, and only falls back to a fresh Discover when the server does not respond. Following the DHCPv4 walkthrough, the DHCPv6 process is examined in the same capture. Rather than broadcasting, DHCPv6 uses link-local addresses and multicast at both Layer 2 and Layer 3, and the exchange follows a comparable back-and-forth pattern between client and server. Together, these captures provide a concrete, packet-level view of how dynamic IP addressing works across both IPv4 and IPv6 environments.

What you'll learn

What's covered

DHCP Process in Wireshark

Aligned to

CompTIA Network+
3.4 Given a scenario, implement IPv4 and IPv6 network services.
Cisco CCNA
4.3 Explain the role of DHCP and DNS within the network.
1.9 Describe IPv6 address types.
Cisco CCST Networking
5.2 Perform a packet capture with Wireshark and save it to a file.
1.5 Describe common network applications and protocols.
Cisco CyberOps Associate
4.8 Interpret the fields in protocol headers as related to intrusion analysis.

Key terms

Dynamic Host Configuration Protocol
DHCP
A network protocol that automatically assigns IP addresses and other configuration parameters to devices on a network.
IP Address
A numerical label assigned to each device connected to a network that uses the Internet Protocol.
Media Access Control
MAC
A sublayer of the Data Link layer that controls how devices on a network gain access to a medium and transmit data.
Port
A logical endpoint for communication in a network, identified by a number that specifies a particular service or application.
User Datagram Protocol
UDP
A connectionless transport protocol that sends data without establishing a connection or guaranteeing delivery.
Broadcast
A transmission type in which one device sends a single packet that is delivered to every other device on the local network segment simultaneously. Broadcast traffic is contained within a broadcast domain and does not cross router boundaries.
Multicast
A transmission type in which data is sent from one source to a specific group of devices that have subscribed to a multicast group address, rather than to all devices or just one. This differs from broadcast (all devices) and unicast (one device).

Transcript

Capturing the Traffic

The DHCP packets start traversing this network as soon as you plug in the device. So what I'm going to do is pull up Wireshark and monitor. What I've got is the Ethernet plug unplugged from the device. I'm going to monitor the Ethernet, and then I'm going to plug this in and see what we capture.

All right, I plugged this machine back in. It generated a lot of packets, and then I've stopped the capture. So I look through here, and what we're looking for are these DHCP ones — the one with the protocol that says DHCP, and that's associated with IP version 4. I can see that this is a DHCP request right here. Let's go ahead and just sort by this protocol, so we group them all together.

We can see it actually makes several requests, and it's not until we get down to this discovery where we actually see that process that I've been talking about, where there is a discovery, then there's an offer, then a request, and then an acknowledgement. These other ones, it looks like to me that it's asking for that same IP address, and for some reason the server is not responding back.

The Four-Step Exchange

And so then we get to this discovery right here. Now it's making a call out, and this is what lines up with what we've been talking about. I see the source is 0.0.0.0, so that means it's just unspecified. It doesn't know an IP address; it doesn't have an IP address yet. So that makes sense. And then the destination is 255.255.255.255, so that is a broadcast. It's going out to all the devices on the network, looking for that DHCP server.

I can open up the layer 2 and I see that the layer 2 is all Fs, so that lines up with that broadcast. It lines up with what we saw with the IP address. And then we see the source is the MAC address of the Dell machine — that's the demo laptop — and so that lines up as well. I mean, it knows its own MAC address, so why not use its own MAC address? And we see that the source port is 68 and the destination port is 67. All things that we talked about before.

We get a response back from the demo Pi. Its IP address is 10.1.0.3, and we can see the MAC address in there is the demo Pi's MAC address, so that makes sense. And it's going directly to 10.1.0.150. It's offering that out, and it's going to the destination of the Dell, saying this is an IP address that's available to you. And of course we've got the source port of 67 and destination port of 68.

Then we click on the request, and the request is once again being sent from 0.0.0.0 and being broadcast out to all the other devices, so that if there were multiple offers, then all of those DHCP servers would know that it's accepted this particular one. We see that the destination layer 2 is a broadcast, all Fs — that makes sense — and the MAC address is of the machine, so that makes sense. And source port 68, destination port of 67. So all of that lines up. It's just toggling between those two different ports.

And then we get down to the DHCP acknowledgement. The DHCP acknowledgement is being sent from the demo Pi, and it's being sent directly to the demo laptop, and it's using, from a layer 2 perspective, those MAC addresses. And once again, source port is 67 and destination port is 68. Then within the DHCP options down here below, we see the information that addresses things like lease time and the subnet. We see subnet mask in here, and the DHCP identifier — that's the server that it's coming from. So we see all of that information that's being sent out within the payload of this DHCP notification there.

It's a four-step process of being sent back and forth to get this DHCP address.

DHCP Version 6

Let's also take a quick glance at DHCP version 6. We scroll down, and it looks like there's some similar activity that's happening. We'll jump to this one right here, which is going from the Dell machine. I know it's the Dell machine because the source MAC address is the MAC address of the Dell machine, so we see that right there. And it's going to the destination of this multicast address, so we see the multicast address in both the layer 2 and the layer 3. So the multicast address here, and it's coming from the layer 3 link local address. We see the layer 3 link local address of the demo laptop.

And it is then getting responded back to here in this packet 182, and in that one it's coming from the link local address of the demo Pi and going to the link local address of the demo laptop. And if we look at the layer 2 once again, we see the source MAC address of the demo Pi and the destination MAC address of the demo laptop.

And then we see a reply back coming from the demo laptop to the demo Pi. That is coming from the link local address of the demo laptop and going to the broadcast address — excuse me, not the broadcast but the multicast address, just like before. And then we see a reply back from the demo Pi, coming from the link local address of the demo Pi and going to the link local address of the demo laptop. So it's a very similar back and forth as we saw with DHCP.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →