How to find the IP address of a DHCP server

When a network interface configured with DHCP is being enabled, a host machine broadcasts DHCP discovery message to discover available DHCP server(s) on the network. Once the host has received a DHCP offer message from any DHCP server, it then sends a DHCP request message to the DHCP server to finalize the lease of an IP address.

If you would like to know the IP address of a DHCP server used for configuring a particular interface (e.g., eth0) on your Linux machine, there are two ways to do it.

Method One

The first method to find the IP address of a DHCP server is to check the DHCP lease information found in /var/lib/dhcp/dhclient.eth0.leases.

$ cat /var/lib/dhcp/dhclient.eth0.leases
lease {
  interface "eth0";
  fixed-address 192.168.1.8;
  option subnet-mask 255.255.255.0;
  option time-offset 0;
  option routers 192.168.1.1;
  option dhcp-lease-time 86399;
  option dhcp-message-type 5;
  option domain-name-servers 192.168.1.1,71.250.0.12;
  option dhcp-server-identifier 192.168.1.1;
  option broadcast-address 192.168.1.255;
  option host-name "new-host-3";
  option domain-name "home";
  renew 5 2012/08/17 13:06:24;
  rebind 6 2012/08/18 00:22:01;
  expire 6 2012/08/18 03:22:01;
}

The DHCP lease file contains detailed information about the DHCP lease, including DHCP lease time, and expiration time. The IP address of a DHCP server is shown in the "dhcp-server-identifier" option field (which is 192.168.1.1 in this example).

Note that depending on your Linux system, the DHCP lease file can be located elsewhere:

/var/lib/dhclient/dhclient-eth0.leases
/var/lib/dhcp3/dhclient.leases

Method Two

An alternative way to check the IP address of a DHCP server is to examine log files in/var/log/ as follows.

sudo grep -R "DHCPOFFER" /var/log/*
/var/log/syslog:Aug 16 23:22:02 debian dhclient: DHCPOFFER from 192.168.1.1 

The log indicates that DHCPOFFER is received from 192.168.1.1 which is the IP address of a DHCP server.

Method Three

Another way is to capture DHCP traffic with a packet sniffing tool such as tcpdump, which will show which IP address DHCP responses originate from. For more details, refer to this tutorial.

Subscribe to Xmodulo

Do you want to receive Linux FAQs, detailed tutorials and tips published at Xmodulo? Enter your email address below, and we will deliver our Linux posts straight to your email box, for free. Delivery powered by Google Feedburner.

The following two tabs change content below.
Dan Nanni is the founder and also a regular contributor of Xmodulo.com. He is a Linux/FOSS enthusiast who loves to get his hands dirty with his Linux box. He likes to procrastinate when he is supposed to be busy and productive. When he is otherwise free, he likes to watch movies and shop for the coolest gadgets.
Your name can also be listed here. Write for us as a freelancer.

Leave a comment

Your email address will not be published. Required fields are marked *