CCNA NOTES 6 # DHCP Explained: DORA Process, APIPA, Relay Agent & Snooping — Complete Notes

 Study Mode

DHCP · APIPA · Relay · Snooping — Complete Notes
Network Protocols · Layer 7 · Application

DHCP & Related Concepts

Dynamic Host Configuration Protocol — DORA · APIPA · Relay Agent · Snooping

Layer 7 — ApplicationProtocol — UDPPort 67 (Server) / 68 (Client)Open Standard · RFC 2131
◈ DHCP DORA Process — 4-Step Handshake
D
DISCOVER
Client → Broadcast
Src: 0.0.0.0
Dst: 255.255.255.255
O
OFFER
Server → Client
Server proposes
an IP address
R
REQUEST
Client → Broadcast
Client accepts
the offered IP
A
ACK
Server → Client
Confirmed — client
assigns the IP
◈
Overview & Why DHCP
Automatically assigns IP address to host devices on a network
Saves time — no manual IP configuration needed
Reduces administrative overhead and human error
Prevents duplicate IP addresses across the network
Increases team productivity significantly
≡
Parameters DHCP Assigns
ParameterDetails
IP AddressAssigned from configured pool
Subnet MaskDefines the network boundary
Default GatewayL3 interface for outside-LAN comms
DNS ServerPrimary & Secondary DNS
Lease DurationCisco = 24 hrs · Windows = 8 hrs
!
Lease = Duration of IP assigned to a user. After expiry, DHCP negotiation restarts automatically.
→
DORA — Packet Details
StepSrc IPDst IPType
Discover0.0.0.0255.255.255.255Broadcast
OfferDHCP IP255.255.255.255Broadcast
Request0.0.0.0255.255.255.255Broadcast
ACKDHCP IPClient IPUnicast
✦
Other DHCP Messages
NAK — IP not valid / rejected
DECLINE — Duplicate IP detected
RELEASE — Client frees the IP
INFORM — Already has IP, needs extra config
{ }
Cisco Config — DHCP Pool
! Step 1 — Exclude reserved IPs first
ip dhcp excluded-address 10.0.0.1 10.0.0.10

! Step 2 — Create the pool
ip dhcp pool MYPOOL
 network        10.0.0.0 255.0.0.0
 default-router 10.0.0.1
 dns-server     8.8.8.8

! On client router interface
ip address dhcp
⚡
APIPA — Auto Private IP Addressing
!
When you see 169.254.x.x — DHCP server is unreachable. APIPA is a self-assigned fallback, not a working IP.
APIPA Address Range
169.254.0.1 – 169.254.255.254
Subnet Mask: 255.255.0.0  |  /16
Client boots → tries to contact DHCP → no response
Self-assigns an IP from the 169.254.x.x range
Keeps polling for DHCP server periodically
When DHCP found → APIPA replaced automatically
✕
No Default Gateway assigned
✕
No internet / routing possible
⇄
DHCP Relay Agent
?
Why needed? DHCP uses broadcasts. Routers do NOT forward broadcasts across subnets — so the relay agent bridges this gap.
Client sends DHCP Discover (broadcast)
Router (relay agent) receives it on the LAN interface
Converts broadcast → unicast and forwards to DHCP server
Server replies → router delivers to the client
Adds Option 82 (relay agent info) to packet
{ }
Cisco Config — Relay Agent
! On the router interface facing clients
interface FastEthernet0/0
 ip helper-address 10.0.0.1
                     ↑ IP of DHCP Server

! Disable Option 82 if causing issues
no ip dhcp snooping information option
✓
One DHCP server can serve multiple subnets using relay agents — no need for a DHCP server in every network segment.
#DHCP#Networking#Cisco#DORA#APIPA#RelayAgent
Page 01 / 02  ·  Network Notes
Network Security · Layer 2 · Switch Feature

DHCP Snooping

Security guard for DHCP — blocks rogue servers · builds binding table · protects against MITM attacks

Layer 2 SecuritySwitch FeatureTrusted / Untrusted PortsBinding Table · ARP Guard
🛡
What & Why — DHCP Snooping
Layer 2 security feature on switches
Monitors all DHCP messages traversing the switch
Allows only trusted DHCP servers to respond with Offer/ACK
Blocks rogue DHCP servers — attacker pretending to be DHCP
Prevents Man-in-the-Middle (MITM) attacks via fake IP assignment
Builds a binding table linking MAC ↔ IP ↔ Port ↔ VLAN
✓ Trusted Port
Connected to real DHCP server or uplink
OFFER / ACK — Allowed
✕ Untrusted Port
Connected to clients / user devices
OFFER / ACK — Blocked
!
Default: ALL switch ports are Untrusted. You must manually mark the DHCP server port as trusted. Never trust user ports.
{ }
Cisco Config — DHCP Snooping
! Enable DHCP snooping globally
ip dhcp snooping

! Enable on specific VLANs
ip dhcp snooping vlan 1,10,20

! Mark the DHCP server port as trusted
interface FastEthernet0/1
 ip dhcp snooping trust

! Disable Option 82 insertion (if needed)
no ip dhcp snooping information option

! Verification commands
show ip dhcp snooping
show ip dhcp snooping binding

! Debug on DHCP server
debug ip dhcp server events
≡
DHCP Snooping Binding Table
IP AddressMAC AddressLease (hr)VLANInterface
10.0.0.1AA:BB:CC:0A241Gi0/1
10.0.0.2AA:BB:CC:0B241Gi0/2
10.0.0.3AA:BB:CC:0C2410Gi0/3
★
🔥 Important Interview & Exam Points
// 01
APIPA range is 169.254.0.0/16. Seeing 169.254.x.x = DHCP server is unreachable. No gateway, no internet.
// 02
DHCP uses UDP. Port 67 = Server, Port 68 = Client. Remember: server number is lower.
// 03
DHCP Relay uses ip helper-address. Converts broadcast → unicast and forwards to DHCP server IP.
// 04
Snooping: all ports untrusted by default. Only port to DHCP server should be trusted. Never trust client ports.
// 05
DORA process: Discover → Offer → Request → Ack. First and third messages are from the client.
// 06
Lease defaults: Cisco = 24 hrs, Windows = 8 hrs. DHCPNAK = server rejects. DECLINE = client rejects (duplicate detected).
✎
My Notes — Add Your Own
Personal Notes
Questions to Review
CONFIDENCE:
REVIEWED ON:_____________ / _____________ / _____
#DHCPSnooping#RogueServer#BindingTable#MITMProtection#CiscoSwitch
Page 02 / 02  ·  Network Notes
Location: New Delhi, Delhi, India

Comments

Post a Comment

Popular posts from this blog

Network Topologies

       Network Topologies 1. Bus Topology Structure: All devices connect to a single shared cable called the Backbone . Termination: Both ends must have 50-ohm terminators to absorb signals. Without them, signals bounce back (Signal Reflection), causing collisions and data loss. Cabling Standards: 10Base5 (Thicknet): Max length 500m . Used for older backbones. 10Base2 (Thinnet): Max length 185m . Used for individual PC connections. Access Method: CSMA/CD (Carrier Sense Multiple Access with Collision Detection). Pros: Easy to set up for very small, temporary networks. Cons: If the backbone cable breaks, the entire network fails. Hard to troubleshoot. Current Status: Obsolete. 2. Ring Topology Structure: Each node is connected to two others, forming a continuous loop. Working (Token Passing): A logical "Token" frame moves around the ring. Only the device holding the token can transmit data, which eliminates collisions . Redundancy (Dual Ring): Used in FDD...
Read more

Network Devices

Image
  Network Devices HUB Hardware device Open standard Non-manageable device Provides continuous broadcasting (sends data to all ports) Works on Physical Layer (Layer 1) of the OSI Model No MAC learning capability Single collision domain and single broadcast domain Half-duplex communication Obsolete (not used in modern networks due to inefficiency) SWITCH Intelligent device Works on MAC addresses Operates on Layer 2 (Data Link Layer) of the OSI Model Used to create and manage LAN networks Ethernet Family Ethernet – 10 Mbps Fast Ethernet – 100 Mbps Gigabit Ethernet – 1 Gbps 10 Gigabit Ethernet – 10 Gbps (corrected from Terabit) MAC Address Hexadecimal format (0–9, A–F) 48-bit address (6 bytes) Each hex value = 4 bits Example: A1:...
Read more

CCNA Notes #01: Computer Networks — Types & Classification (Complete Guide)

Computer Networks — Types & Classification A complete reference covering what a network is, how networks are classified, and the key types you need to know for CCNA — built from classroom notes, teacher explanations, and structured revision. 1 What is a Network & Networking? What A  network  is a group of two or more devices connected together so they can share information with each other.  Networking  is the purposeful process of setting up, using, maintaining, and troubleshooting those connections to make that sharing actually work. Why Without a network, every device is isolated — you'd have to physically transfer files, share printers one at a time, or duplicate data everywhere. Networking removes that friction and allows resources, services, and data to be shared efficiently. Key terms to know Intranet Private, internal communication within an organization or domain Internet Public communication with the World Wide Web—open to everyone 2 How Networks Are...
Read more