2026-06-02

DHCP Failure PCAP Analysis: Discover, Offer, Request, ACK, NAK, and No IP Address Problems

How to troubleshoot DHCP failure, no IP address, DHCP Discover without Offer, DHCP NAK, relay problems, VLAN issues, and packet capture evidence.

dhcp failure, no ip address, dhcp discover no offer, dhcp nak, vlan troubleshooting, pcap analysis

When a device cannot get an IP address, everything above it fails. Users search for "DHCP Discover no Offer", "DHCP failure pcap", "DHCP NAK troubleshooting", "device gets 169.254 address", and "no IP address packet capture" because the visible symptom is usually just "network not connected."

DHCP is easy to understand when the four-message flow is visible. It is hard to guess when only the client error is visible. PCAP Surgery helps isolate the DHCP exchange while preserving broadcast traffic, relay fields, options, and timing.

Healthy DHCP flow

A typical IPv4 DHCP flow:

Client -> Broadcast: DHCP Discover
Server -> Client/Broadcast: DHCP Offer
Client -> Broadcast: DHCP Request
Server -> Client/Broadcast: DHCP ACK

If the client receives ACK, it can configure IP address, subnet mask, router, DNS, lease time, and other options.

Discover but no Offer

If the capture shows Discover messages but no Offer, likely causes include:

  • DHCP server unreachable.
  • VLAN mismatch.
  • Relay not configured.
  • Switch port isolation.
  • DHCP snooping policy.
  • Server scope exhausted.
  • Firewall blocks broadcast/relay traffic.
  • Client is on the wrong network.

Capture location matters. If you capture on the client and see Discover leave but no Offer return, you still need to know whether the server received it.

Offer but no Request

If Offer appears but the client never sends Request, the client may reject the offer due to options, wrong network, duplicate address detection, or client policy.

Inspect:

  • Offered IP.
  • Server identifier.
  • Subnet mask.
  • Router option.
  • Lease time.
  • Vendor-specific options.

NAK

DHCP NAK means the server rejects the client's requested address or lease state. This often happens after moving between networks or VLANs.

Look for:

  • Client requests old IP.
  • Server sends NAK.
  • Client restarts discovery.
  • Repeated NAK loop.

The fix may be normal lease renewal behavior, but repeated NAKs indicate configuration or network mismatch.

Relay and VLAN problems

In routed networks, DHCP relay forwards client requests to a server. The giaddr field and relay information options matter. If relay is missing or wrong, the server may not know which scope to use.

Preserve DHCP options when trimming a capture. Removing them destroys the evidence.

Checklist

Use this workflow:

  1. Capture from link-up or device boot.
  2. Filter DHCP/BOOTP traffic.
  3. Determine which messages appear: Discover, Offer, Request, ACK, NAK.
  4. Inspect transaction IDs.
  5. Check offered address and options.
  6. Check server identifier.
  7. Check relay fields and VLAN context.
  8. Look for repeated retries and timing.
  9. Compare client-side and server-side captures if needed.
  10. Preserve full DHCP options.

Final diagnosis

DHCP failure is not just "no IP." The packet evidence shows whether the client asked, server answered, client accepted, server acknowledged, server rejected, or relay/VLAN prevented the exchange.

PCAP Surgery helps reduce noisy boot captures into the exact DHCP sequence needed to prove why the device did not get an address.