What is DHCP Lease?

Understanding DHCP Lease

A DHCP lease is the time-limited assignment of an IP address, along with related network configuration, from a DHCP server to a client device. Defined in RFC 2131, the lease specifies how long the client may use the address before it must renew or release it, allowing a finite address pool to be shared dynamically across many devices.

A client obtains a lease through the four-step DORA exchange: Discover, Offer, Request, and Acknowledge. The server's ACK delivers the IP address plus options such as subnet mask, default gateway, DNS servers, and the lease duration. The client starts renewal at the T1 timer (50% of the lease) by unicasting a request to the original server; if that fails, it tries to rebind at T2 (87.5%) by broadcasting to any server. If the lease fully expires without renewal, the address returns to the pool for reassignment.

DHCP leases matter for security and operations because they govern which devices hold which addresses and for how long, which is essential for accountability and forensics. Lease logs map IP addresses to MAC addresses and timestamps, letting investigators trace an event back to a specific device. Lease behavior is also a target for attack: rogue DHCP servers can hand out malicious gateway or DNS settings, and DHCP starvation attacks exhaust the address pool to deny service. DHCP snooping on switches mitigates these by trusting only authorized servers.

For example, a guest connects a laptop to a corporate wireless network. The DHCP server issues a one-hour lease with an address from the guest VLAN, the gateway, and an internal DNS resolver. Thirty minutes in, at the T1 timer, the laptop silently renews the lease to keep the same address. When the guest leaves and the hour expires without renewal, the address is reclaimed into the pool. Later, a security analyst reviewing DHCP lease logs can confirm exactly which MAC address held that IP during the visit.