Core Networking · Study deck

DHCP and Address Resolution

Picture a replacement sensor joining a plant network and receiving an address once held by another unit.

Packet Pete is your guide for this deck.

addrdhcpresolution

Packet Pete, the module guide, in a scene from this chapter.

After studying this chapter

Learning objectives

You will be able to:

Explain: This reading constrains the dhcp dora exchange assigns address settings; it does not by itself prove local frame delivery and supplies the visual evidence for overview: addressing has two jobs.
Explain: Asset systems should bind a cryptographic device identity, enrollment record, certificate, or managed account to the currently observed interface address and retain the time-bounded mapping as evidence.
Explain: For globally assigned unicast addresses, the first 24 bits commonly contain an IEEE organisationally unique identifier and the remaining bits come from an assigned device block.
Explain: A broker is a service that accepts and routes messages.

Major section

Start With How the Device Learns the Network

A dashboard can reach that address while attaching the new reading to the wrong asset record.

A MAC address is a link-layer identifier carried by a network interface.
A gateway is the device or service that joins two system paths.
A broker is a service that accepts and routes messages.

Major section

Start With How the Device Learns the Network (continued)

Reachability is not identity or trust.

This runway does not prove secure enrolment or correct application mapping.
The deeper sections explain address assignment, leases, local resolution, name lookup, default routes, and the evidence that joins those steps.
Most IoT devices do not wake up already knowing their useful network identity.

Major section

Overview: Addressing Has Two Jobs

That visual pairing grounds the dhcp dora exchange assigns address settings; it does not by itself prove local frame delivery in named evidence.

This reading constrains the dhcp dora exchange assigns address settings; it does not by itself prove local frame delivery and supplies the visual evidence for overview: addressing has two jobs.

The same eight bits as voltage steps on copper, light pulses in fibre, and a keyed radio carrier — and the connector, transceiver or antenna that forms each physical boundary.

Major section

Under the Hood: Diagnose ARP, Neighbor Discovery, and Conflicts

ARP resolves only a local next hop; for a remote destination, that next hop should be the gateway.

The sequence shows that prefix discovery and duplicate-address detection are separate checks, each leaving different diagnostic evidence.
A tentative address must survive that final check before normal use.

ARP request and reply on a local IPv4 segment

Major section

Under the Hood: Diagnose ARP, Neighbor Discovery, and Conflicts (continued)

This connects neighbor-cache and router-advertisement evidence to the conflict investigation: address formation, local reachability, and uniqueness are related but distinct operational claims.

The candidate address is formed, but Duplicate Address Detection blocks it before any 6LoWPAN fragments are transmitted.
The trace should change the diagnosis order.
When DAD blocks the address, DNS and application checks are not failures yet; they are prerequisites that never became testable.

Major section

Address Configuration Fallbacks

Automatic configuration is a sequence of distinct services.

An IPv4 host normally broadcasts DHCP discovery before it has a usable address.
Two such hosts on the same link may communicate, but the address supplies neither a default gateway nor evidence that the enterprise DHCP path works.
IPv6 separates more responsibilities.

A cold lookup for telemetry.example.net delegated down the DNS hierarchy, above a matrix of what DHCPv4, APIPA, RA + SLAAC, DHCPv6 and NDP each actually provide.

Major section

Address Configuration Fallbacks (continued)

A host first creates a link-local address and can then receive a router advertisement containing an on-link prefix and default-router lifetime.

SLAAC forms an address from that prefix and an interface identifier; DHCPv6 can provide a managed address or additional options.
Basic neighbour discovery does not itself promise a DNS resolver, although modern networks may include Recursive DNS Server options in router advertisements.
If those options are absent, DNS information can arrive through DHCPv6 or manual policy.
A device can have a valid lease and route while DNS fails, or resolve a cached name while its default route is already broken.

Major section

MAC Identity Evidence

They do not change byte order on the wire.

For globally assigned unicast addresses, the first 24 bits commonly contain an IEEE organisationally unique identifier and the remaining bits come from an assigned device block.
The broadcast destination is ff:ff:ff:ff:ff:ff--all 48 bits are one.

Ethernet MAC header with the destination and source address fields highlighted; one address split into IEEE-assigned OUI and vendor-assigned device octets, its first octet expanded to bits; and the colon, hyphen and dotted renderings of the same 48 bits.

Major section

MAC Identity Evidence (continued)

A 48-bit MAC address contains 12 hexadecimal digits because each digit represents four bits.

That split is allocation evidence, not guaranteed manufacturer or asset identity: virtual interfaces, locally administered addresses, replacements, and privacy mechanisms can all break that inference.
A switch floods such a frame within the relevant broadcast domain; a router does not normally carry that layer-2 broadcast into another link.
The address can rotate between associations or after policy changes.

Major section

MAC Identity Evidence (continued)

Ordinary unicast MAC addresses likewise need to be unique only within the layer-2 domain in which they are simultaneously used.

Wireless clients may generate a locally administered address for scanning or for each network profile so observers cannot correlate one permanent hardware address across locations.
Consequently, an observed MAC is a link-delivery identifier at a time and place, not automatically a durable device key.
Asset systems should bind a cryptographic device identity, enrollment record, certificate, or managed account to the currently observed interface address and retain the time-bounded mapping as evidence.

Major section

Summary

Gateway ARP table shows 192.168.10.45 alternating between two MAC addresses.

DHCP leases show Sensor A was assigned.45 and Sensor B was assigned.67.
Sensor B is found with a manually configured static.45 address.
Lease duration should match device mobility and maintenance risk, with long leases for fixed sensors and shorter leases for mobile or temporary devices.

Deck summary

Key takeaways

A dashboard can reach that address while attaching the new reading to the wrong asset record.

Reachability is not identity or trust.
That visual pairing grounds the dhcp dora exchange assigns address settings; it does not by itself prove local frame delivery in named evidence.
ARP resolves only a local next hop; for a remote destination, that next hop should be the gateway.
This connects neighbor-cache and router-advertisement evidence to the conflict investigation: address formation, local reachability, and uniqueness are related but distinct operational claims.

Retrieval practice

Recall check 1 of 3

Packet Pete says: answer from memory, then check your reasoning.

Q1A sensor receives an IP address, subnet mask, gateway, DNS server, and lease time from DHCP but still cannot send data to its local gateway. What should you check next?

AWhether DHCP used UDP port 80 instead of a web browser port.

BWhether ARP or IPv6 ND resolved the gateway to a local link-layer address.

CWhether DNS has translated the sensor's MAC address into a hostname.

DWhether the lease is permanent and can never be renewed.

Show answer

Answer: B DHCP and address resolution solve different parts of the same connectivity chain: configuration first, local delivery next.

Retrieval practice

Recall check 2 of 3

Packet Pete says: answer from memory, then check your reasoning.

Q2A warehouse has 300 permanently mounted PoE RFID readers with one-hour DHCP leases. During a two-hour DHCP maintenance window, many readers lose connectivity. Which policy best fits this device class?

AUse longer leases, such as 7 to 30 days, and keep reservations for readers that must have predictable addresses.

BUse one-minute leases so failed readers can get new addresses faster.

CPlace routers and DHCP servers inside the dynamic sensor pool so every address is managed the same way.

DRemove all DHCP evidence and troubleshoot only from application dashboard screenshots.

Show answer

Answer: A Lease duration should match device mobility and maintenance risk.

Retrieval practice

Recall check 3 of 3

Packet Pete says: answer from memory, then check your reasoning.

Q3A sensor at 192.168.200.50/16 tries to reach a PLC at 192.168.100.20 through a router, but it never sends traffic to the gateway. What is the most likely addressing error?

AThe /16 mask makes the sensor think 192.168.100.20 is local

BThe PLC is too old to communicate with an IoT sensor over IP.

CDHCP Discover messages must be sent after every ARP request.

DIPv6 Neighbor Discovery has disabled all IPv4 forwarding.

Show answer

Answer: A Subnet masks decide whether a destination is local or remote.

Print reference

Answers

Answer key.

B · DHCP and address resolution solve different parts of the same connectivity chain: configuration first, local delivery next.
A · Lease duration should match device mobility and maintenance risk.
A · Subnet masks decide whether a destination is local or remote.