How to find the IP address of a DHCP server

Last updated on August 23, 2020 by Dan Nanni

When a network interface configured with DHCP is being enabled, a host machine broadcasts DHCP discovery message to discover available DHCP server(s) on the network. Once the host has received a DHCP offer message from any DHCP server, it then sends a DHCP request message to the DHCP server to finalize the lease of an IP address.

If you would like to know the IP address of a DHCP server used for configuring a particular interface (e.g., eth0) on your Linux machine, there are two ways to do it.

Method One

The first method to find the IP address of a DHCP server is to check the DHCP lease information found in /var/lib/dhcp/dhclient.eth0.leases.

$ cat /var/lib/dhcp/dhclient.eth0.leases

lease {
  interface "eth0";
  fixed-address 192.168.1.8;
  option subnet-mask 255.255.255.0;
  option time-offset 0;
  option routers 192.168.1.1;
  option dhcp-lease-time 86399;
  option dhcp-message-type 5;
  option domain-name-servers 192.168.1.1,71.250.0.12;
  option dhcp-server-identifier 192.168.1.1;
  option broadcast-address 192.168.1.255;
  option host-name "new-host-3";
  option domain-name "home";
  renew 5 2012/08/17 13:06:24;
  rebind 6 2012/08/18 00:22:01;
  expire 6 2012/08/18 03:22:01;
}

The DHCP lease file contains detailed information about the DHCP lease, including DHCP lease time, and expiration time. The IP address of a DHCP server is shown in the dhcp-server-identifier option field (which is 192.168.1.1 in this example).

Note that depending on your Linux system, the DHCP lease file can be located elsewhere:

/var/lib/dhclient/dhclient-eth0.leases
/var/lib/dhcp3/dhclient.leases

Method Two

An alternative way to check the IP address of a DHCP server is to examine log files in /var/log/ as follows.

sudo grep -R "DHCPOFFER" /var/log/*

/var/log/syslog:Aug 16 23:22:02 debian dhclient: DHCPOFFER from 192.168.1.1

The log indicates that DHCPOFFER is received from 192.168.1.1 which is the IP address of a DHCP server.

Method Three

Another way is to capture DHCP traffic with a packet sniffing tool such as tcpdump, which will show which IP address DHCP responses originate from. For more details, refer to this tutorial.

Support Xmodulo

This website is made possible by minimal ads and your gracious donation via PayPal or credit card

Please note that this article is published by Xmodulo.com under a Creative Commons Attribution-ShareAlike 3.0 Unported License. If you would like to use the whole or any part of this article, you need to cite this web page at Xmodulo.com as the original source.