DHCP报文格式
DHCP报文是承载于UDP上的高层协议报文，采用67（DHCP服务器）和68（DHCP客户端）两个端口号。DHCP的报文格式如下图所示。
报文格式
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| op (1) | htype (1) | hlen (1) | hops (1) |
+---------------+---------------+---------------+---------------+
| xid (4) |
+-------------------------------+-------------------------------+
| secs (2) | flags (2) |
+-------------------------------+-------------------------------+
| ciaddr (4) |
+---------------------------------------------------------------+
| yiaddr (4) |
+---------------------------------------------------------------+
| siaddr (4) |
+---------------------------------------------------------------+
| giaddr (4) |
+---------------------------------------------------------------+
~ chaddr (16) ~
+---------------------------------------------------------------+
~ sname (64) ~
+---------------------------------------------------------------+
~ file (128) ~
+---------------------------------------------------------------+
~ options (variable) ~
+---------------------------------------------------------------+
DHCP报文字段含义
| 字段 | 长度 | 含义 |
|---|---|---|
| Op | 1B |
表示报文的类型： |
| Htype | 1B | 表示硬件地址的类型。对于以太网，该类型的值为“1”。 |
| Hlen | 1B | 表示硬件地址的长度，单位是字节。对于以太网，该值为6。 |
| Hops | 1B | 跳数。客户端设置为0，也能被一个代理服务器设置。 |
| Xid | 4B | 事务ID，由客户端选择的一个随机数，被服务器和客户端用来在它们之间交流请求和响应，客户端用它对请求和应答进行匹配。该ID由客户端设置并由服务器返回，为32位整数。 |
| Secs | 2B | 由客户端填充，表示从客户端开始获得IP地址或IP地址续借后所使用了的秒数。 |
| flags | 2B | 此字段在BOOTP中保留未用，在DHCP中表示标志字段。 |
| Ciaddr | 4B | 客户端的IP地址。只有客户端是Bound、Renew、Rebinding状态，并且能响应ARP请求时，才能被填充。 |
| Yiaddr | 4B | "你自己的"或客户端的IP地址。 |
| Siaddr | 4B | 表明DHCP协议流程的下一个阶段要使用的服务器的IP地址。 |
| Giaddr | 4B | 该字段表示第一个DHCP中继的IP地址（注意：不是地址池中定义的网关）。当客户端发出DHCP请求时，如果服务器和客户端不在同一个网络中，那么第一个DHCP中继在转发这个DHCP请求报文时会把自己的IP地址填入此字段。服务器会根据此字段来判断出网段地址，从而选择为用户分配地址的地址池。服务器还会根据此地址将响应报文发送给此DHCP中继，再由DHCP中继将此报文转发给客户端。 若在到达DHCP服务器前经过了不止一个DHCP中继，那么第一个DHCP中继后的中继不会改变此字段，只是把Hops的数目加1。 |
| Chaddr | 16B | 该字段表示客户端的MAC地址，此字段与前面的“Hardware Type”和“Hardware Length”保持一致。当客户端发出DHCP请求时，将自己的硬件地址填入此字段。对于以太网，当“Hardware Type”和“Hardware Length”分别为“1”和“6”时，此字段必须填入6B的以太网MAC地址。 |
| Sname | 64B | 该字段表示客户端获取配置信息的服务器名字。此字段由DHCP Server填写，是可选的。如果填写，必须是一个以0结尾的字符串。 |
| file | 128B | 该字段表示客户端的启动配置文件名。此字段由DHCP Server填写，是可选的，如果填写，必须是一个以0结尾的字符串。 |
| options | 可变 | 该字段表示DHCP的选项字段，至少为312B，格式为"代码+长度+数据"。DHCP通过此字段包含了服务器分配给终端的配置信息，如网关IP地址，DNS服务器的IP地址，客户端可以使用IP地址的有效租期等信息。 |
Flags字段格式
1
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|B| MBZ |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
只有标志字段的最高位才有意义，其余的位均被置为0。最左边的字段被解释为广播响应标志位，内容如下所示： 0：客户端请求服务器以单播形式发送响应报文；1：客户端请求服务器以广播形式发送响应报文
DHCP Options
| Option id | 属性名 | Length（B） | 参考文档 |
|---|---|---|---|
| 0 | Pad | 1 | RFC 2132 |
| 1 | Subnet Mask | 4 | RFC 2132 |
| 2 | Time Offset | 4 | RFC 2132 |
| 3 | Router | 4*N | RFC 2132 |
| 4 | Time Server | 4*N | RFC 2132 |
| 5 | Name Server | 4*N | RFC 2132 |
| 6 | Domain Server | 4*N | RFC 2132 |
| 7 | Log Server | 4*N | RFC 2132 |
| 8 | Quotes Server | 4*N | RFC 2132 |
| 9 | LPR Server | 4*N | RFC 2132 |
| 10 | Impress Server | 4*N | RFC 2132 |
| 11 | RLP Server | 4*N | RFC 2132 |
| 12 | Hostname | n | RFC 2132 |
| 13 | Boot File Size | 2 | RFC 2132 |
| 14 | Merit Dump File | N | RFC 2132 |
| 15 | Domain Name | n | RFC 2132 |
| 16 | Swap Server | 4 | RFC 2132 |
| 17 | Root Path | N | RFC 2132 |
| 18 | Extension File | N | RFC 2132 |
| 19 | Forward On/Off | 1 | RFC 2132 |
| 20 | SrcRte On/Off | 1 | RFC 2132 |
| 21 | Policy Filter | 8*N | RFC 2132 |
| 22 | Max DG Assembly | 2 | RFC 2132 |
| 23 | Default IP TTL | 1 | RFC 2132 |
| 24 | MTU Timeout | 4 | RFC 2132 |
| 25 | MTU Plateau | 2*N | RFC 2132 |
| 26 | MTU Interface | 2 | RFC 2132 |
| 27 | MTU Subnet | 1 | RFC 2132 |
| 28 | Broadcast Address | 4 | RFC 2132 |
| 29 | Mask Discovery | 1 | RFC 2132 |
| 30 | Mask Supplier | 1 | RFC 2132 |
| 31 | Router Discovery | 1 | RFC 2132 |
| 32 | Router Request | 4 | RFC 2132 |
| 33 | Static Route | 8*N | RFC 2132 |
| 34 | Trailers | 1 | RFC 2132 |
| 35 | ARP Timeout | 4 | RFC 2132 |
| 36 | Ethernet | 1 | RFC 2132 |
| 37 | Default TCP TTL | 1 | RFC 2132 |
| 38 | Keepalive Time | 4 | RFC 2132 |
| 39 | Keepalive Data | 1 | RFC 2132 |
| 40 | NIS Domain | N | RFC 2132 |
| 41 | NIS Servers | 4*N | RFC 2132 |
| 42 | NTP Servers | 4*N | RFC 2132 |
| 43 | Vendor Specific | n | RFC 2132 |
| 44 | NETBIOS Name Srv | 4*N | RFC 2132 |
| 45 | NETBIOS Dist Srv | 4*N (N>=1) | RFC 2132 |
| 46 | NETBIOS Node Type | 1 | RFC 2132 |
| 47 | NETBIOS Scope | N (N>=1) | RFC 2132 |
| 48 | X Window Font | 4*N(N>=1) | RFC 2132 |
| 49 | X Window Manager | 4*N(N>=1) | RFC 2132 |
| 50 | Address Request | 4 | RFC 2132 |
| 51 | IP Address Lease Time | 4 | RFC 2132 |
| 52 | Overload | 1 | RFC 2132 |
| 53 | DHCP Msg Type | 1 | RFC 2132 |
| 54 | Server Identifier | 4 | RFC 2132 |
| 55 | Parameter List | n | RFC 2132 |
| 56 | DHCP Message | N (N>=1) | RFC 2132 |
| 57 | DHCP Max Msg Size | 2 | RFC 2132 |
| 58 | Renewal Time | 4 | RFC 2132 |
| 59 | Rebinding Time | 4 | RFC 2132 |
| 60 | Class Id | n | RFC 2132 |
| 61 | Client Id | n | RFC 2132 |
| 62 | NetWare/IP Domain | N (1<=N<=255) | RFC 2242 |
| 63 | NetWare/IP Option | N (1<=N<=255) | RFC 2242 |
| 64 | NIS-Domain-Name | n | RFC 2132 |
| 65 | NIS-Server-Addr | 4*N (N>=1) | RFC 2132 |
| 66 | Server-Name | N | RFC 2132 |
| 67 | Bootfile-Name | N | RFC 2132 |
| 68 | Home-Agent-Addrs | 4*N(N>=0) | RFC 2132 |
| 69 | SMTP-Server | 4*N (N>=1) | RFC 2132 |
| 70 | POP3-Server | 4*N (N>=1) | RFC 2132 |
| 71 | NNTP-Server | 4*N (N>=1) | RFC 2132 |
| 72 | WWW-Server | 4*N (N>=1) | RFC 2132 |
| 73 | Finger-Server | 4*N (N>=1) | RFC 2132 |
| 74 | IRC-Server | 4*N (N>=1) | RFC 2132 |
| 75 | StreetTalk-Server | 4*N (N>=1) | RFC 2132 |
| 76 | STDA-Server | 4*N (N>=1) | RFC 2132 |
| 77 | User-Class | n | RFC 3004 |
| 78 | Directory Agent | 4*N+1 | RFC 2610 |
| 79 | Service Scope | N | RFC 2610 |
| 80 | Rapid Commit | 0 | RFC 4039 |
| 81 | Client FQDN | n (n>=3) | RFC 4702 |
| 82 | Relay Agent Information | n | RFC 3046 |
| 83 | iSNS | N | RFC 4174 |
| 84 | REMOVED/Unassigned | N | - |
| 85 | NDS Servers | 4*N (N>=1) | RFC 2241 |
| 86 | NDS Tree Name | N (1<=N<=255) | RFC 2241 |
| 87 | NDS Context | N (1<=N<=255) | RFC 2241 |
| 88 | BCMCS Controller Domain Name list | n | RFC 4280 |
| 89 | BCMCS Controller IPv4 address option | 4*n (n>=1) | RFC 4280 |
| 90 | Authentication | N | RFC 3118 |
| 91 | client-last-transaction-time option | 4 | RFC 4338 |
| 92 | associated-ip option | 4*N | RFC 4338 |
| 93 | Client System | 2*N (N>= |
RFC 4578 |
| 94 | Client NDI | 3 | RFC 4578 |
| 95 | LDAP | N | RFC 3679 |
| 96 | IPv6 Transition | N | RFC 3679 |
| 97 | UUID/GUID | N | RFC 4578 |
| 98 | User-Auth | N | RFC 2485 |
| 99 | GEOCONF_CIVIC | n (n>=3) | RFC 4776 |
| 100 | PCode | N | RFC 4833 |
| 101 | TCode | N | RFC 4833 |
| 102-107 | REMOVED/Unassigned | - | - |
| 108 | REMOVED/Unassigned | - | - |
| 109 | Unassigned | - | - |
| 110 | REMOVED/Unassigned | - | - |
| 111 | Unassigned | - | - |
| 112 | Netinfo Address | N | RFC 3679 |
| 113 | Netinfo Tag | N | RFC 3679 |
| 114 | URL | N | RFC 3679 |
| 115 | REMOVED/Unassigned | - | - |
| 116 | Auto-Config | 1 | RFC 2563 |
| 117 | Name Service Search | N (N>=2) | RFC 2937 |
| 118 | Subnet Selection Option | 4 | RFC 3011 |
| 119 | Domain Search | n | RFC 3397 |
| 120 | SIP Servers DHCP Option | n | RFC 3361 |
| 121 | Classless Static Route Option | n | RFC 3442 |
| 122 | CCC | N (N<=255) | RFC 3495 |
| 123 | GeoConf Option | 16 | RFC 6225 |
| 124 | V-I Vendor Class | - | RFC 3925 |
| 125 | V-I Vendor-Specific Information | n | RFC 3925 |
| 126 | Removed/Unassigned | - | - |
| 127 | Removed/Unassigned | - | - |
| 128 | PXE - undefined (vendor specific) | - | RFC 4578 |
| 128 | Etherboot signature. 6 bytes: E4:45:74:68:00:00 | - | RFC 4578 |
| 128 | DOCSIS "full security" server IP address | - | RFC 4578 |
| 128 | TFTP Server IP address (for IP Phone software load) | - | RFC 4578 |
| 129 | PXE - undefined (vendor specific) | - | RFC 4578 |
| 129 | Kernel options. Variable length string | - | RFC 4578 |
| 129 | Call Server IP address | - | RFC 4578 |
| 130 | PXE - undefined (vendor specific) | - | RFC 4578 |
| 130 | Ethernet interface. Variable length string. | - | RFC 4578 |
| 130 | Discrimination string (to identify vendor) | - | RFC 4578 |
| 131 | PXE - undefined (vendor specific) | - | RFC 4578 |
| 131 | Remote statistics server IP address | - | RFC 4578 |
| 132 | PXE - undefined (vendor specific) | - | RFC 4578 |
| 132 | IEEE 802.1Q VLAN ID | - | RFC 4578 |
| 133 | PXE - undefined (vendor specific) | - | RFC 4578 |
| 133 | IEEE 802.1D/p Layer 2 Priority | - | RFC 4578 |
| 134 | PXE - undefined (vendor specific) | - | RFC 4578 |
| 134 | Diffserv Code Point (DSCP) for VoIP signalling and media streams | - | RFC 4578 |
| 135 | PXE - undefined (vendor specific) | - | RFC 4578 |
| 135 | HTTP Proxy for phone-specific applications | - | RFC 4578 |
| 136 | OPTION_PANA_AGENT | 4*N (N>=1) | RFC 5192 |
| 137 | OPTION_V4_LOST | N | RFC 5223 |
| 138 | OPTION_CAPWAP_AC_V4 | 4*N (N>=1) | RFC 5417 |
| 139 | OPTION-IPv4_Address-MoS | N | RFC 5678 |
| 140 | OPTION-IPv4_FQDN-MoS | N | RFC 5678 |
| 141 | SIP UA Configuration Service Domains | n (n<=255) | RFC 6011 |
| 142 | OPTION-IPv4_Address-ANDSF | 4*N | RFC 6153 |
| 143 | OPTION-IPv6_Address-ANDSF | 16*N | RFC 6153 |
| 144 | GeoLoc | 16 | RFC 6225 |
| 145-149 | Unassigned | - | - |
| 150 | TFTP server address (Tentatively Assigned - 2005-06-23) | 4*N (N>=1) | RFC 5859 |
| 150 | Etherboot | - | - |
| 150 | GRUB configuration path name | - | - |
| 151 | Unassigned | - | - |
| 152 | Unassigned | - | - |
| 153-174 | Unassigned | - | - |
| 175 | Etherboot (Tentatively Assigned - 2005-06-23) | - | - |
| 176 | IP Telephone (Tentatively Assigned - 2005-06-23) | - | - |
| 177 | Etherboot (Tentatively Assigned - 2005-06-23) | - | - |
| 177 | PacketCable and CableHome (replaced by 122) | - | - |
| 178-207 | Unassigned | - | - |
| 208 | PXELINUX Magic | 4 | RFC 5071 |
| 209 | Configuration File | N | RFC 5071 |
| 210 | Path Prefix | N | RFC 5071 |
| 211 | Reboot Time | 4 | RFC 5071 |
| 212 | OPTION_6RD | n | RFC 5969 |
| 213 | Access Network Domain Name DHCPv4 Option | n | RFC 5986 |
| 214-219 | - | - | |
| 220 | Subnet Allocation Option (Tentatively Assigned - 2005-06-23) | - | - |
| 221 | Virtual Subnet Selection Option (Tentatively Assigned - 2005-06-23) | n (n>=1) | RFC 6607 |
| 222-223 | Unassigned | - | - |
| 224-254 | Reserved (Private Use) | - | - |
| 255 | End | 1 | - |
参考标准
| 标准 | 描述 |
|---|---|
| Bootstrap Protocol (BOOTP) | |
| Clarifications and Extensions for the Bootstrap Protocol | |
| Dynamic Host Configuration Protocol | |
| DHCP Options and BOOTP Vendor Extensions | |