Gary VirkIT Specialist
← All work

03 IT support · DHCP · Packet evidence

DHCP failure isolation

A controlled DHCP run separates a missing offer, incorrect lease options, and two servers answering the same transaction.

Issue
Did the client receive no offer, accept incorrect network options, or choose between two DHCP servers?
Decisive evidence
The captures show three distinct conditions: no offer returned, incorrect router and DNS options, and two servers answering one transaction.E01
Result
The packet sequence separates no response, incorrect lease options, and two responding servers.
Boundary
This is an isolated Linux service and client lab.Full limit
Completion
Complete within stated scope
Execution
Isolated ARM64 Linux packet lab
Review
Analyzer replay and manifest review
Evidence
Selected evidence on this page
  • Kea DHCP
  • BusyBox udhcpc
  • TShark
  • Linux namespaces

Project scope

What was built and checked.

Project record: Isolated service and client states, each packet exchange, the DHCP fields that distinguish the failures, and a post-correction capture.

Interactive view

Read the exchange before changing the service.

The same client symptom can stop at a different packet or complete with the wrong options.

Choose a view

One server completes the four-message exchange with the reviewed router and DNS values.

  1. 01
    DiscoverClient asks for a lease
  2. 02
    OfferServer proposes an address
  3. 03
    RequestClient selects an offer
  4. 04
    ACKServer confirms options

Packet workflow

Read the exchange before changing the service.

  1. 01

    Capture the complete client exchange inside an isolated lab with no default route.

  2. 02

    Change one server condition at a time.

  3. 03

    Read the message type, transaction, server identifier, router, and DNS fields.

  4. 04

    Restore the intended service state and capture a new expected four-message exchange.

Evidence from the lab

The checks used to reach the conclusion.

Selected outputs from the lab. Sensitive and unnecessary details are omitted.

Finding types : none
DORA          : complete
Router        : 198.51.100.1
DNS           : 198.51.100.10
E01 · Derived from captured lab outputBaseline analyzer reportA sanitized report derived from the private baseline capture records a complete four-message exchange and the expected router and DNS values.
View artifact Back to C01 
Finding       : no_offer
Discover      : present
Offer         : absent
Capture state : complete
E02 · Derived from captured lab outputNo-offer analyzer reportThe client Discover is present, the capture closes after the response window, and no Offer is recorded.
View artifact Back to C01 
DORA            : complete
Observed router : 198.51.100.254
Observed DNS    : 192.0.2.53
Finding         : incorrect_option
E03 · Derived from captured lab outputIncorrect-options analyzer reportThe lease completes, but the Offer and Acknowledgment contain router and DNS values that differ from the declared lab baseline.
View artifact Back to C01
Full evidence archive2 additional artifacts
Offer servers : 198.51.100.2, 198.51.100.3
Selected       : 198.51.100.2
Findings       : competing_offers, incorrect_option
E04 · Derived from captured lab outputCompeting-server analyzer reportTwo server identifiers answer the same transaction. The client selects the expected server while the second offer carries different router and DNS values.
View artifact Back to C01 
Finding types : none
DORA          : complete
Selected      : 198.51.100.2
Router / DNS  : expected
E05 · Derived from captured lab outputClean repeat analyzer reportA separate captured exchange returns one selected server, a complete four-message sequence, and the expected router and DNS values.
View artifact Back to C01

Result and limits

What changed, and what this lab does not prove.

Result

The captured exchanges separated an absent response, a completed lease with incorrect options, and a transaction with two responding servers. A clean repeat restored one expected offer with the reviewed router and DNS values.

Limit

This is an isolated Linux service and client lab. Public downloads are sanitized analyzer records derived from private captures. It does not claim Windows client behavior, relay testing, or production DHCP administration.

Claims and evidence

What the evidence supports.

The captures show three distinct conditions: no offer returned, incorrect router and DNS options, and two servers answering one transaction.

The evidence comes from an isolated Linux lab; raw packet captures remain private.

EvidenceE01E02E03E04E05