Both DHCP request and responses are UDP requests. If you use a sniffer to identify the pattern of the request responses, the following is what you might see. The following was taken from dhclient running in FreeBSD 6.1.
Len SrcIP SrcMACAddr DestIP DestMACAddr Protocol
342 0.0.0.0 00:0c:29:c1:13:81 255.255.255.255 ff:ff:ff:ff:ff:ff UDP
62 192.168.49.254 00:50:56:ef:75:a8 192.168.49.128 ff:ff:ff:ff:ff:ff ICMP ping request
342 192.168.49.254 00:50:56:ef:75:a8 192.168.49.128 00:0c:29:c1:13:81 UDP
60 192.168.49.128 00:0c:29:c1:13:81 ff:ff:ff:ff:ff:ff ARP request
If you observe the source and destination (IP, MACAddr) patterns, it is easy to appreciate what happens. Here is what happens:
- A DHCP request is sent on the network. Both destination MACAddr and IPAddr are broadcast addresses.
- The DHCP server chooses and IP address to offer and confirms if the IP address it is not used anywhere else in the network.
- DHCP server offers the IP address to the requester.
- The requester sends an ARP request to register its MAC address and IP address in interested hosts in the network.