Part 1: IP Address Classes (The Historical Foundation)

Before 1993, the internet used Classful Networking to allocate IP addresses. The 32-bit IPv4 address space was rigidly divided into five classes based on the first few bits of the address.

Classful networking is obsolete, replaced in 1993 by CIDR (Classless Inter-Domain Routing). However, understanding classes is still required for reading legacy documentation, passing security interviews, and understanding default subnet masks.*

The 5 Classes:

1. Class A (Massive Networks)
   • Range: 1.0.0.0 to 126.255.255.255 (First bit is always 0).
   • Default Subnet Mask: 255.0.0.0 (/8).
   • Capacity: 126 networks, each supporting ~16 million hosts.
   • Use Case: Originally allocated to massive organizations (e.g., IBM, AT&T) and ISPs. (Note: 127.0.0.0/8 is reserved for Loopback/localhost).
2. Class B (Medium to Large Networks)
   • Range: 128.0.0.0 to 191.255.255.255 (First two bits are 10).
   • Default Subnet Mask: 255.255.0.0 (/16).
   • Capacity: ~16,000 networks, each supporting ~65,000 hosts.
   • Use Case: Originally allocated to large universities and mid-sized corporations.
3. Class C (Small Local Networks)
   • Range: 192.0.0.0 to 223.255.255.255 (First three bits are 110).
   • Default Subnet Mask: 255.255.255.0 (/24).
   • Capacity: ~2 million networks, each supporting 254 hosts.
   • Use Case: Small businesses and local LANs. This is the most common class you will see in default enterprise configurations.
4. Class D (Multicast)
   • Range: 224.0.0.0 to 239.255.255.255 (First four bits are 1110).
   • Use Case: Not assigned to individual hosts. Used for Multicast routing (e.g., routing protocols like OSPF, or streaming video to multiple receivers simultaneously).
5. Class E (Experimental)
   • Range: 240.0.0.0 to 255.255.255.255 (First four bits are 1111).
   • Use Case: Reserved for R&D and future use. Never used in production.

The Architectural Shift to CIDR: Classful addressing was incredibly wasteful (a company needing 300 IPs had to be given a Class B with 65,000 IPs). CIDR eliminated classes by allowing variable-length subnet masking (VLSM). Today, you allocate exactly what you need (e.g., a /27 for 30 IPs) using AWS VPCs or Azure VNets.

---

Part 2: DHCP (Dynamic Host Configuration Protocol) Explained

DHCP is the protocol that automates the assignment of IP addresses, subnet masks, default gateways, and DNS servers to devices on a network. Without DHCP, network administrators would have to manually configure every laptop, server, and IoT device (Static IP).

1. How DHCP Works: The DORA Process

DHCP operates over UDP (Port 67 for the Server, Port 68 for the Client) and uses a four-step process known as DORA:

1. D – DHCP Discover: The client boots up, has no IP, and broadcasts a message (DHCPDISCOVER) to the entire local subnet (Destination IP: 255.255.255.255). “Is there a DHCP server out there?”
2. O – DHCP Offer: The DHCP server receives the broadcast, checks its pool of available IPs, and sends a unicast (or broadcast) reply (DHCPOFFER). “I have IP 192.168.1.50 available for you, along with these DNS and Gateway settings.”
3. R – DHCP Request: The client broadcasts (DHCPREQUEST) to let all servers know which offer it is accepting. “I accept the offer from Server A for IP 192.168.1.50.”
4. A – DHCP Acknowledge: The chosen server finalizes the process (DHCPACK), officially leasing the IP to the client and updating its database. “The IP is yours for the next 8 hours.”

2. The DHCP Relay Agent (Crucial for Enterprise Architecture)

Because DHCP uses broadcasts (Layer 2), a DHCP client cannot reach a DHCP server located on a different subnet (routers block broadcasts).

• The Solution: In enterprise networks with hundreds of subnets (VLANs), we do not put a DHCP server on every VLAN. Instead, we configure the Layer 3 Router (or Layer 3 Switch) with a DHCP Relay Agent (e.g., ip helper-address in Cisco). The router intercepts the client’s broadcast, encapsulates it, and unicasts it directly to the centralized DHCP server.

---

Part 3: DHCP in Modern Cloud & Enterprise Architecture

We must understand how DHCP behaves in the cloud, as it is heavily abstracted.

• AWS (Amazon Web Services): AWS uses the VPC DHCP Options Set. You cannot run your own traditional Windows DHCP server inside a standard AWS VPC. AWS automatically assigns private IPs to EC2 instances and ENIs (Elastic Network Interfaces) using its internal, highly available DHCP infrastructure. You can customize the DNS servers and domain names via the DHCP Options Set, but you cannot control the IP assignment logic itself.
• Azure (Microsoft Azure): Similar to AWS, Azure VNets have built-in DHCP. When you deploy a VM, the Azure fabric assigns it a private IP from the VNet’s subnet range. You configure the DNS settings at the VNet level.
• Hybrid/On-Prem: In your VMware or physical data centers, you likely run Windows Server DHCP, ISC DHCP, or Cisco ISE.

---

Part 4: DHCP Security Threats (The Security Leader’s View)

While DHCP is a convenience protocol, it is a massive security vulnerability if left unprotected. Because DHCP operates on trust (the client blindly accepts whatever IP and Gateway the server tells it to), attackers can easily exploit it.

1. Rogue DHCP Server (The Man-in-the-Middle Attack)

• The Attack: An attacker plugs a rogue device (or runs software like dnsmasq) into the corporate LAN and configures it as a DHCP server. When a legitimate client broadcasts a DHCPDISCOVER, the rogue server responds faster than the legitimate server with a DHCPOFFER.
• The Impact: The rogue server assigns the client an IP address, but sets the Default Gateway and DNS Server to the attacker’s machine. The attacker is now perfectly positioned to intercept, read, and modify all outbound traffic from that client (Man-in-the-Middle).
• The Mitigation:
  • DHCP Snooping: A feature configured on Layer 2 switches. The switch is told which ports are connected to legitimate DHCP servers. It drops any DHCP server responses coming from unauthorized ports.
  • 802.1X (Port-Based NAC): Prevents unauthorized devices from even connecting to the network switch port in the first place.

2. DHCP Starvation (Denial of Service)

• The Attack: The attacker uses a tool to rapidly send thousands of DHCPREQUEST packets, each with a spoofed, random MAC address.
• The Impact: The DHCP server quickly exhausts its pool of available IP addresses. When legitimate employees try to connect to the network, the server has no IPs left to give them, causing a localized Denial of Service (DoS).
• The Mitigation: Configure Port Security on switches to limit the number of MAC addresses allowed on a single port. Implement 802.1X to ensure only authenticated users can request IPs.

3. MAC Spoofing & Bypassing Reservations

• The Attack: In many environments, network access is tied to a device’s MAC address (e.g., “Only the CEO’s laptop MAC address gets the executive VLAN via DHCP”). An attacker simply changes (spoofs) their laptop’s MAC address to match the CEO’s.
• The Mitigation: This highlights why MAC-based security is dead. You must transition to Identity-Based Security (802.1X, EAP-TLS certificates, or Zero Trust Network Access) where the user’s cryptographic identity is verified, not their easily forged hardware MAC address.