Skip to main content
Back to path

Welcome to a Grasp lesson

Create a free account to keep studying and create your own study path.

Lesson 34

DHCP DORA Process: A Wireshark Walkthrough

Recommended resources

Introduction

Welcome back! In our last lesson, we demystified the Dynamic Host Configuration Protocol (DHCP) and theoretically traced the four-step DORA (Discover, Offer, Request, Acknowledge) process. We saw how a device joining a network goes from having no IP address to being fully configured for communication.

Today, we transition from theory to hands-on practice. Your goal for this lesson is to use Wireshark to capture and analyze your own computer's live DHCP conversation. This exercise will solidify your understanding of the DORA process by letting you see the raw packets firsthand, connecting the "book knowledge" directly to what's happening on your network.

1. Preparing for a Live DHCP Capture

To capture the DORA process, we need to force your computer to request a new IP address. The standard way to do this is to first release your current IP address lease and then renew it. This will trigger the full four-step DORA exchange.

The commands to do this differ slightly depending on your operating system. You will need to run these from a command-line interface with administrative privileges.

  • For Windows:

    • Open Command Prompt or PowerShell as an Administrator.
    • Release command: ipconfig /release
    • Renew command: ipconfig /renew

  • For macOS or Linux:

    • Open the Terminal.
    • These commands require superuser privileges, so you'll use sudo.
    • Release command: sudo dhclient -r (You might need to specify the interface, e.g., sudo dhclient -r en0)
    • Renew command: sudo dhclient (Again, you might need to specify the interface, e.g., sudo dhclient en0)

A Quick Note: Performing this on a Wi-Fi connection can sometimes be less reliable for capturing the DORA process cleanly. If possible, using a wired Ethernet connection is ideal. If not, the process should still work, but you might see extra wireless management frames in your capture.

2. Lab: Capturing and Analyzing Your DORA Process

Now, let's put it all together. Follow these steps to capture the exchange.

  1. Launch Wireshark.
  2. On the welcome screen, you'll see a list of network interfaces. Double-click the one you are actively using for your internet connection (e.g., Ethernet or Wi-Fi). The capture will begin immediately.
  3. Go to your administrative command prompt or terminal.
  4. Execute the release command for your OS. You will temporarily lose internet connectivity.
  5. Immediately execute the renew command.
  6. Once your connection is restored, go back to Wireshark and click the red square "Stop" button to stop the capture.
  7. In the "Apply a display filter" bar at the top, type bootp and press Enter. The bootp filter is commonly used because DHCP is an extension of the older Bootstrap Protocol. This will filter out all other traffic, leaving only the DHCP packets.

You should now see four packets in your capture list: Discover, Offer, Request, and Acknowledge.

Wireshark Capture of DHCP DORA Process
Your capture should look similar to this Wireshark screenshot, showing the four distinct packets of the DORA process in sequence.

Now, let's analyze what you've found. Click on each packet and inspect the "Packet Details" pane to confirm the following details we discussed in the last lesson.

  • DHCP Discover:

    • Check the IPv4 layer. Is the source IP 0.0.0.0 and the destination 255.255.255.255?
    • Expand the "Dynamic Host Configuration Protocol (Discover)" section. Can you find your device's MAC address listed under Client MAC address?

  • DHCP Offer:

    • Who is the source of this packet? This is your DHCP server (likely your home router).
    • Expand the DHCP section. What IP address is being offered in the Your (client) IP address field? What is the IP Address Lease Time?

  • DHCP Request:

    • Note that the source is 0.0.0.0 and the destination is a broadcast (255.255.255.255) again. Your client is broadcasting its acceptance.
    • In the DHCP options, find Option: (54) DHCP Server Identifier. Does this match the IP of the server from the Offer packet?
    • Find Option: (50) Requested IP Address. Does this match the IP from the Offer?

  • DHCP Acknowledge (ACK):

    • This is the final confirmation from the server.
    • Expand the DHCP section and confirm the Your (client) IP address field contains your newly assigned IP. At this point, the process is complete!

This hands-on exercise is the best way to see how a fundamental internet protocol works in reality, moving from abstract concepts to concrete data packets.

3. Guided Analysis with a Sample Capture

To reinforce what you've just done, let's work through a structured analysis using a pre-made capture file. This ensures you can apply the same analytical steps to any DHCP capture you might encounter.

The following resource from Infoblox provides a lab guide and a .pcap file for just this purpose.

Analyzing DHCP Options with Wireshark (3537)

This lab guide will walk you through analyzing a clean DHCP capture. It's a great way to practice your Wireshark filtering and analysis skills in a controlled environment.

Please read through the instructions from the start down to the end of 'Task 5 Solution'. Follow these steps: Download the DORA-capture.pcap file linked in 'Task 1'. Open it in Wireshark. Follow the steps in the 'Solutions' sections for each task to filter and inspect the packets. Pay close attention to the specific filter syntax and the options you're asked to find (like Option 55 and Option 50).

Working through this lab will solidify your ability to not only identify the DORA packets but also to drill down into the specific options that carry the essential configuration data.

For a final visual reinforcement of what each packet contains, you can refer back to the excellent video by Chris Greer we saw in the last lesson.

How DHCP Works // DHCP EXPLAINED

If you need a quick refresher on the details of any of the DORA packets while you're analyzing, this video is a perfect reference. The presenter methodically breaks down each field.

Use this video as a reference guide. For example, if you're curious about a specific field in the Discover packet you're seeing in Wireshark, jump to the relevant section (00:30 - 06:04) in the video for a detailed explanation.

Conclusion

Congratulations! You have successfully moved from theory to practice by capturing and analyzing a live DHCP transaction. This is a core skill in network troubleshooting and analysis.

Key Takeaways:

  • You can trigger a DHCP exchange on your own machine using commands like ipconfig /release and ipconfig /renew.
  • Using Wireshark with the bootp filter allows you to isolate and view the four DORA packets.
  • By inspecting the packet details, you can trace the entire negotiation: the client's broadcast for help, the server's offer, the client's formal request, and the server's final acknowledgment.
  • You confirmed key details like source/destination IPs, MAC addresses, lease times, and requested options within the raw packet data.

Preview of the Next Lesson:

We've now mastered how a device gets its local IP configuration (IP address, subnet mask, default gateway). But what happens next? When you try to access a website, your computer sends the packets to the default gateway. But how does that gateway, a router, know where to send the packets from there?

In our next lesson, we will begin our exploration of the Network Layer by diving into Routing Fundamentals. We'll look at the structure of an IP packet and see how routers use routing tables to make decisions and forward data across the vast network of networks that is the internet.