What is DORA?

What is DORA?

DORA is the mnemonic for the four messages a DHCP client and server exchange when a client joins a network without a lease. DHCP runs over UDP: the server listens on port 67 and the client on port 68. Because the client starts with no IP address, the first steps rely on broadcasts.

The four steps

1. Discover (DHCPDISCOVER): the client broadcasts from source 0.0.0.0 to 255.255.255.255 on UDP port 67, asking any DHCP server to respond. The message carries the client's MAC address.
2. Offer (DHCPOFFER): each server that hears it proposes an address from its scope, along with the subnet mask, lease time and options such as the default gateway and DNS servers.
3. Request (DHCPREQUEST): the client picks one offer, usually the first, and broadcasts a request that names the chosen server. Other servers see it and withdraw their offers.
4. Acknowledge (DHCPACK): the chosen server confirms the lease and the client configures its adapter. Many clients first use ARP to check that no other device already has the address.

If the requested address is no longer valid, the server answers with a DHCPNAK and the client starts over with a Discover. Other DHCP messages include DHCPDECLINE (the client found the address already in use), DHCPRELEASE (the client gives the address back) and DHCPINFORM (a statically addressed client asks only for options).

Renewals skip the first two steps

A client that already holds a lease does not repeat the whole process. At 50% of the lease it sends a unicast DHCPREQUEST to its server and gets a DHCPACK back. Only when renewal and rebinding both fail and the lease expires does the client go back to a Discover.

Crossing routers

Routers do not forward broadcasts, so a Discover never leaves its own subnet. When the DHCP server sits on another subnet, the router (or another device on the client's subnet) acts as a DHCP relay agent, often configured as an IP helper. It picks up the broadcast and forwards it to the server as unicast, adding its own interface address so the server can pick the scope for that subnet.

When DORA fails

• No Offer arrives: a Windows client gives itself an APIPA address from 169.254.0.0/16 and keeps trying to reach a DHCP server in the background. Check the cable or Wi-Fi association, the DHCP service, scope exhaustion and the relay agent.
• The wrong server answers: clients get addresses from an unexpected range or the wrong gateway. A rogue DHCP server, often a consumer router plugged into the LAN, answered first.
• Testing:ipconfig /release followed by ipconfig /renew forces a fresh Discover. A packet capture filtered on UDP ports 67 and 68 shows each step.

DHCPv6 is different

IPv6 clients that use stateful DHCPv6 exchange Solicit, Advertise, Request and Reply messages on UDP ports 546 (client) and 547 (server). Many IPv6 networks rely on router advertisements and SLAAC (stateless address autoconfiguration) instead.

DORA on the CompTIA A+ exam

Core 1 objective 2.1 lists DHCP on ports 67/68, objective 2.4 covers DHCP leases, scope, reservations and exclusions, and objective 2.6 includes APIPA and dynamic addressing. Know the four steps in order, that Discover and Request are broadcasts, that the server uses port 67 and the client port 68, and that a 169.254.x.x address on Windows means the client never completed DORA. A question that asks which message follows the Offer expects Request. If a question describes clients on one subnet getting addresses from a server on another, think relay agent.