Core Networking · Study deck

DHCP and Address Resolution

Picture a replacement sensor joining a plant network and receiving an address once held by another unit.

Packet Pete is your guide for this deck.

addrdhcpresolution

After studying this chapter

Learning objectives

You will be able to:

Explain: For globally assigned unicast addresses, the first 24 bits commonly contain an IEEE organisationally unique identifier and the remaining bits come from an assigned device block.
Explain: Two such hosts on the same link may communicate, but the address supplies neither a default gateway nor evidence that the enterprise DHCP path works.
Explain: That split is allocation evidence, not guaranteed manufacturer or asset identity: virtual interfaces, locally administered addresses, replacements, and privacy mechanisms can all break that inference.
Explain: ARP resolves only a local next hop; for a remote destination, that next hop should be the gateway.

ARP request and reply on a local IPv4 segment

Major section

Start With How the Device Learns the Network

A dashboard can reach that address while attaching the new reading to the wrong asset record.

A MAC address is a link-layer identifier carried by a network interface.
A gateway is the device or service that joins two system paths.
A broker is a service that accepts and routes messages.

Major section

Start With How the Device Learns the Network (continued)

Reachability is not identity or trust.

This runway does not prove secure enrolment or correct application mapping.
The deeper sections explain address assignment, leases, local resolution, name lookup, default routes, and the evidence that joins those steps.
Most IoT devices do not wake up already knowing their useful network identity.

The same eight bits as voltage steps on copper, light pulses in fibre, and a keyed radio carrier — and the connector, transceiver or antenna that forms each physical boundary.

Major section

Overview: Addressing Has Two Jobs

The client requests the lease it has chosen, which matters when more than one server answered.

The device now holds an address, a mask and a gateway, but not one frame has yet reached a peer.
The second job, local delivery, is still unproven.
The client broadcasts a discover, because it has no address yet and does not know the server.

The DHCP DORA exchange assigns address settings; it does not by itself prove local frame delivery.

Major section

Under the Hood: Diagnose ARP, Neighbor Discovery, and Conflicts

ARP resolves only a local next hop; for a remote destination, that next hop should be the gateway.

The sequence shows that prefix discovery and duplicate-address detection are separate checks, each leaving different diagnostic evidence.
A tentative address must survive that final check before normal use.
This connects neighbor-cache and router-advertisement evidence to the conflict investigation: address formation, local reachability, and uniqueness are related but distinct operational claims.
The candidate address is formed, but Duplicate Address Detection blocks it before any 6LoWPAN fragments are transmitted.

Major section

Address Configuration Fallbacks

Automatic configuration is a sequence of distinct services.

An IPv4 host normally broadcasts DHCP discovery before it has a usable address.
Two such hosts on the same link may communicate, but the address supplies neither a default gateway nor evidence that the enterprise DHCP path works.
IPv6 separates more responsibilities.

Major section

Address Configuration Fallbacks (continued)

A host first creates a link-local address and can then receive a router advertisement containing an on-link prefix and default-router lifetime.

SLAAC forms an address from that prefix and an interface identifier; DHCPv6 can provide a managed address or additional options.
Basic neighbour discovery does not itself promise a DNS resolver, although modern networks may include Recursive DNS Server options in router advertisements.
If those options are absent, DNS information can arrive through DHCPv6 or manual policy.
A device can have a valid lease and route while DNS fails, or resolve a cached name while its default route is already broken.

Major section

MAC Identity Evidence

They do not change byte order on the wire.

For globally assigned unicast addresses, the first 24 bits commonly contain an IEEE organisationally unique identifier and the remaining bits come from an assigned device block.
Dst MAC and Src MAC come at the front, so a switch can start its choice before the whole frame arrives.
A 48-bit MAC address contains 12 hexadecimal digits because each digit represents four bits.
The last card shows colon, dash, and dotted forms.

Ethernet MAC diagram marks destination and source six-octet addresses in the frame, then expands C8:60:00:BA:95:65 into six bytes. It distinguishes the IEEE OUI from the assigned device block, shows C8 as bits, and compares colon, hyphen and dotted spellings. — An Ethernet address has OUI and device bytes, while colon, hyphen, and dotted forms write the same 48 bits.

Major section

MAC Identity Evidence (continued)

The broadcast destination is ff:ff:ff:ff:ff:ff--all 48 bits are one.

That split is allocation evidence, not guaranteed manufacturer or asset identity: virtual interfaces, locally administered addresses, replacements, and privacy mechanisms can all break that inference.
A switch floods such a frame within the relevant broadcast domain; a router does not normally carry that layer-2 broadcast into another link.
The address can rotate between associations or after policy changes.

IPv6 SLAAC sequence from router discovery through duplicate-address detection

Major section

MAC Identity Evidence (continued)

Figure: An Ethernet address has OUI and device bytes compresses the last three paragraphs into one review sheet: where the two address fields sit in the frame, how the 48 bits decompose, and why three spellings are one address.

Ordinary unicast MAC addresses likewise need to be unique only within the layer-2 domain in which they are simultaneously used.
Wireless clients may generate a locally administered address for scanning or for each network profile so observers cannot correlate one permanent hardware address across locations.
Consequently, an observed MAC is a link-delivery identifier at a time and place, not automatically a durable device key.

The I/G and U/L flag bits of the first octet, then three addresses as captured in the wild: a burned-in global unicast, the all-ones broadcast, and a rotating locally administered address.

Major section

Summary

Gateway ARP table shows 192.168.10.45 alternating between two MAC addresses.

DHCP leases show Sensor A was assigned.45 and Sensor B was assigned.67.
Sensor B is found with a manually configured static.45 address.
Lease duration should match device mobility and maintenance risk, with long leases for fixed sensors and shorter leases for mobile or temporary devices.

Deck summary

Key takeaways

A dashboard can reach that address while attaching the new reading to the wrong asset record.

Reachability is not identity or trust.
The client requests the lease it has chosen, which matters when more than one server answered.
ARP resolves only a local next hop; for a remote destination, that next hop should be the gateway.
Automatic configuration is a sequence of distinct services.

Retrieval practice

Recall check 1 of 3

Packet Pete says: answer from memory, then check your reasoning.

Q1A sensor receives an IP address, subnet mask, gateway, DNS server, and lease time from DHCP but still cannot send data to its local gateway. What should you check next?

AWhether ARP or IPv6 ND resolved the gateway to a local link-layer address.

BWhether DHCP used UDP port 80 instead of a web browser port.

CWhether DNS has translated the sensor's MAC address into a hostname.

DWhether the lease is permanent and can never be renewed.

Show answer

Answer: A DHCP and address resolution solve different parts of the same connectivity chain: configuration first, local delivery next.

Retrieval practice

Recall check 2 of 3

Packet Pete says: answer from memory, then check your reasoning.

Q2A warehouse has 300 permanently mounted PoE RFID readers with one-hour DHCP leases. During a two-hour DHCP maintenance window, many readers lose connectivity. Which policy best fits this device class?

AUse one-minute leases so outage-affected readers renew more often.

BUse longer leases and reservations for readers needing stable addresses.

CPut infrastructure servers in the dynamic reader-address pool.

DRely on dashboard screenshots instead of DHCP allocation evidence.

Show answer

Answer: B Lease duration should match device mobility and maintenance risk.

Retrieval practice

Recall check 3 of 3

Packet Pete says: answer from memory, then check your reasoning.

Q3A sensor at 192.168.200.50/16 tries to reach a PLC at 192.168.100.20 through a router, but it never sends traffic to the gateway. What is the most likely addressing error?

AThe PLC is too old to communicate with an IoT sensor over IP.

BThe DHCP lease has expired, so the sensor must request a fresh lease before routing.

CIPv6 Neighbor Discovery is intercepting the PLC's IPv4 route.

DThe /16 mask makes the sensor think 192.168.100.20 is local

Show answer

Answer: D Subnet masks decide whether a destination is local or remote.

Print reference

Answers

Answer key.

A · DHCP and address resolution solve different parts of the same connectivity chain: configuration first, local delivery next.
B · Lease duration should match device mobility and maintenance risk.
D · Subnet masks decide whether a destination is local or remote.