What is a DHCP scope?
A scope is the unit of configuration on a DHCP server. Each scope covers one subnet and defines which addresses the server may hand out there and what extra settings clients receive with each address. A SOHO router has a single scope that you set as a start and end address (or a start address and a maximum number of clients). A Windows Server DHCP server can hold many scopes, one for each subnet it serves.
What a scope contains
- Address range: a start and end address, for example 192.168.10.100 to 192.168.10.200.
- Subnet mask: for example 255.255.255.0 (/24).
- Exclusions: addresses inside the range that the server must never offer.
- Reservations: fixed addresses tied to a specific client's MAC address.
- Lease duration: how long a client may keep an address before it must renew.
- Scope options: extra settings delivered to every client in the scope.
Common DHCP options
| Option | Name | What the client gets |
|---|---|---|
| 3 | Router | Default gateway |
| 6 | DNS Servers | DNS server addresses |
| 15 | DNS Domain Name | Connection-specific DNS suffix |
| 51 | IP Address Lease Time | Lease duration |
| 66 and 67 | Boot Server Host Name, Bootfile Name | Where PXE clients find a network boot file |
On Windows Server, options can be set at the server level (all scopes), the scope level, or on a single reservation. The more specific level wins, so a scope option overrides a server option.
Building a scope on Windows Server
- Install the DHCP Server role and, in a domain, authorize the server in Active Directory.
- In the DHCP console (
dhcpmgmt.msc), run the New Scope Wizard under IPv4. - Enter the start and end addresses and the subnet mask.
- Add exclusions for statically addressed devices.
- Set the lease duration (the wizard defaults to 8 days).
- Configure at least options 3 and 6, then activate the scope.
A scope that was never activated, or a domain server that was never authorized, hands out no addresses.
Sizing and multiple subnets
A scope can never be larger than its subnet. A /24 has 254 usable host addresses, and the router, servers and printers use some of them. When every address in the pool is leased, new clients get no offer and Windows falls back to APIPA (169.254.x.x). Fixes include shortening the lease, clearing stale leases, or moving to a larger subnet. A DHCP starvation attack causes the same symptom on purpose by requesting addresses until the pool is empty.
One server can serve remote subnets as long as each subnet has its own scope and the routers forward DHCP broadcasts through a DHCP relay agent (IP helper). A superscope groups several scopes when more than one logical subnet runs on the same physical segment. For redundancy, administrators either split a range between two servers (the classic 80/20 split) or use the DHCP failover feature in Windows Server.
Troubleshooting cues
- New devices get 169.254.x.x while devices that joined earlier work: the scope is probably exhausted.
- Clients get an address but cannot reach other subnets or the internet: check option 3 (Router).
- Clients can ping by IP address but names do not resolve: check option 6 (DNS Servers).
- Two devices report an IP address conflict: a static address sits inside the scope without an exclusion.
- Clients receive addresses from an unexpected range: look for a rogue DHCP server.
DHCP scope on the CompTIA A+ exam
Scope is a bullet under DHCP in Core 1 objective 2.4, next to leases, reservations and exclusions, and DHCP itself is one of the server roles in objective 2.3. Know that a scope is the address pool plus its settings for one subnet, that options deliver the default gateway and DNS servers, and how scope exhaustion shows up on a client (an APIPA address). If a question asks which DHCP setting defines the range of addresses offered, the answer is the scope; if it asks which setting keeps one address inside that range from being offered, it is an exclusion.