Day 2 - DHCP and NTP: Two Services That Hand Out Addresses and Sync Clocks

📌 Key Takeaways

• DHCP automatically distributes "space (addresses)" and NTP automatically distributes "time" across the whole network — both are infrastructure services.
• DHCP hands out IP, gateway, and DNS as a lease through the 4 steps of DORA (Discover → Offer → Request → Ack). Ports are server 67 / client 68 (UDP).
• DISCOVER is a broadcast, so it cannot cross a router → other subnets need a DHCP relay.
• In dhcpd.conf, range is the dynamic pool, and host + hardware ethernet (MAC) + fixed-address is a fixed reservation. It is safest to keep fixed IPs outside the pool.
• NTP's stratum: the lower the number, the more accurate (0 is the reference clock itself, 1 is a primary server, 16 is unsynchronized). The modern Linux standard is chrony, inspected with chronyc sources, chronyc tracking, and timedatectl.

The Problem DHCP Solves — The Limits of Manual IP Management

• Problems that arise when you type in IPs by hand one by one:
  • Writing the same IP on two machines causes an IP conflict.
  • A laptop must be reconfigured every time it moves between meeting rooms.
  • At the scale of hundreds of machines, management itself becomes impossible.
• With DHCP, the server manages an IP address pool centrally and lends addresses out as a lease each time a client boots.

• DHCP hands down not only the IP but the whole set of settings such as subnet mask, default gateway, DNS servers, and domain name.
• In other words, the client receives not just one IP but "every coordinate needed to join the network" in one go.

What DHCP gives is not ownership but a lease. It lends the address only for a set period (lease time), and the client attempts to renew about halfway through. That is why the IP of a device that has left is reclaimed over time and reused. The key point is that, unless it is a static IP, "this IP is mine forever" does not hold.

DORA — The DHCP 4-Step Handshake

• The process by which a client gets an IP has four steps, called DORA after the initial letters.
• Memorize the order and direction precisely.

[Client]                              [DHCP server]
     |---- DISCOVER (broadcast) --------->|   No IP yet → starts from 0.0.0.0
     |<--- OFFER (includes proposed IP) --|
     |---- REQUEST (acceptance notice) -->|
     |<--- ACK (lease confirmed) ---------|
     |          The IP is now usable       |

• The first DISCOVER goes out as a broadcast (255.255.255.255) because the client has no IP yet.
• If there are multiple DHCP servers, each can send an OFFER. The client usually picks the offer that arrives first.
• The REQUEST states "which server's offer was accepted", informing the remaining servers of the rejection.

DHCP uses UDP, with the server on port 67 and the client on port 68. Because the client must communicate while it has no IP, the source IP is 0.0.0.0 and the destination is the broadcast address. Also, because broadcasts cannot cross a router, to use a DHCP server on another subnet you must configure a DHCP relay (relay agent) on the intermediate router so that it forwards the request on the client's behalf. "DHCP is broadcast, so beyond a router a relay is needed" is the key point.

dhcpd.conf — Core Directives of the DHCP Server Configuration

• A Linux DHCP server consists of the package dhcp, the daemon dhcpd, and the config file /etc/dhcp/dhcpd.conf.

# Install
yum install dhcp-server
 
# Daemon control
systemctl start dhcpd
systemctl enable dhcpd
 
# Check lease status
cat /var/lib/dhcpd/dhcpd.leases

• The skeleton of the config file is as follows.

# Global defaults
default-lease-time 600;          # Default lease time (seconds)
max-lease-time 7200;             # Maximum lease time (seconds)
authoritative;                   # Declare this the official DHCP server for this network
 
subnet 192.168.1.0 netmask 255.255.255.0 {
    range 192.168.1.100 192.168.1.200;        # IP range to hand out (pool)
    option routers 192.168.1.1;               # Default gateway
    option subnet-mask 255.255.255.0;         # Subnet mask
    option domain-name-servers 192.168.1.10;  # DNS server
    option domain-name "example.com";         # Domain name
}
 
# Assign a fixed IP to a specific device (by MAC)
host printer {
    hardware ethernet 00:1A:2B:3C:4D:5E;      # Target MAC address
    fixed-address 192.168.1.50;               # Always gives this IP
}

⚠️ Trap: When reserving a fixed IP, the key is to identify the device with hardware ethernet (MAC address) and specify the IP to give with fixed-address. In this case, it is safest to keep the fixed IP outside the dynamic pool specified by range — placing it inside the pool can conflict with dynamic distribution. Also make sure the IP range of range does not include the gateway or server IPs.

DHCP's predecessor is BOOTP (Bootstrap Protocol). BOOTP was created so that diskless workstations could get an IP at boot, but it assigned addresses permanently and required manual mapping. DHCP extended it by adding the concepts of "lease" and "automatic pool management", so even now it shares the same ports (67/68) and much of the message format. That is why you often see BOOTP-compatibility options in dhcpd.conf.

DHCP Client — The Receiving Side

• On the client side, use dhclient to request and renew an IP.

# Request an IP lease (specified interface)
dhclient eth0
 
# Release the current lease (give it back)
dhclient -r eth0
 
# Check lease info
cat /var/lib/dhclient/dhclient.leases

• If Linux is holding a 169.254.x.x (APIPA, link-local) IP, it is a sign that "no DHCP server was found".
• In this case, check the DHCP server, relay, and network connection.

NTP and Time Synchronization — Why Clocks Must Be in Sync

• What happens when a server's clock drifts:
  • Log timestamps get tangled, making failure tracing impossible.
  • TLS certificates are misjudged as "not yet valid" or "expired".
  • Time-based authentication (Kerberos, TOTP) fails.
  • Database replication and distributed transactions break.
• That is why NTP is used to align all nodes to a trusted reference clock.
• NTP divides the trust distance of a time source into strata (layers).

Memory anchors:

• The lower the number, the closer to the reference and the more accurate. Stratum 1 is the top (0 is the clock itself).
• Our servers usually synchronize to a Stratum 2~3 pool on the internet (pool.ntp.org).
• Stratum 16 is a special value meaning "not synchronized".

NTP does not simply "receive the time and overwrite it"; it computes the round-trip delay and offset, compensates for network latency, and gradually adjusts (slews) the clock. Suddenly jumping the time would break logs and timers, so for small errors it smoothly aligns the clock by making it run slightly faster or slower. This is why time synchronization is not a simple copy.

chrony — The Standard Time Synchronization on Modern Linux

• Replacing the traditional ntpd, the default time-sync daemon on the RHEL/CentOS family today is chrony.
• Design goal: to synchronize faster and more accurately in environments with frequent disconnections or unstable networks, like laptops.

# Install
yum install chrony
 
# Daemon control
systemctl start chronyd
systemctl enable chronyd

• The config file is /etc/chrony.conf.

# Time servers (or pool) to synchronize with
pool 2.pool.ntp.org iburst
server time.bora.net iburst       # Specify a particular server
 
# Record the system clock to the RTC (hardware clock)
rtcsync
 
# Allow providing time to clients (downstream network)
allow 192.168.1.0/24
 
# Treat itself as stratum 10 when external sync is unavailable
local stratum 10

• The status-check commands (practical exam targets) are these four.

chronyc sources            # List and status of time sources being synchronized
chronyc sources -v         # Verbose (includes legend)
chronyc tracking           # Current sync accuracy, offset, stratum
timedatectl                # System time, timezone, whether NTP sync is on

⚠️ Trap: In the output of chronyc sources, the symbol in front of a source carries meaning. * is the reference source currently being synchronized to, + is a candidate, ? is unreachable, and x is a falseticker (a bad clock). Questions also ask about the difference that server specifies a single machine while pool specifies a pool for which DNS returns multiple IPs. If ntpd and chrony are run at the same time, they conflict over UDP port 123 (not 53), so only one of them should be on.

Try It Yourself — Checking Time and DHCP Status

# Time status at a glance
timedatectl                # Whether NTP is synchronized, local/UTC time, timezone
chronyc tracking           # Check the reference server, offset, stratum
chronyc sources            # Which servers it is attached to
 
# Change timezone
timedatectl set-timezone Asia/Seoul
 
# Renew the DHCP lease immediately and verify
dhclient -r eth0 && dhclient eth0
ip addr show eth0          # Check the received IP

• If you see NTP synchronized: yes in the timedatectl output, the time is properly synchronized.
• Looking at Stratum and Last offset (the current error) in chronyc tracking together lets you gauge the sync quality.

Tomorrow we move on to the web server, Apache, which serves real content on top of this infrastructure.

📖 Glossary

• Lease : The way DHCP lends an IP for a limited period rather than "owning" it. It attempts renewal about halfway through.
• DORA : The 4 DHCP steps Discover → Offer → Request → Ack.
• DHCP relay (relay agent) : A feature that forwards DHCP requests on a client's behalf past a router that broadcasts cannot cross.
• range : The directive in dhcpd.conf that sets the IP range (pool) to hand out dynamically.
• fixed-address + hardware ethernet : The combination that always reserves the same IP for a device with a specific MAC address.
• authoritative : The directive declaring this server the official DHCP server for that subnet.
• BOOTP : The predecessor of DHCP. Created for diskless workstations, and passed down its ports and message format.
• APIPA (169.254.x.x) : The link-local address a client assigns itself when it cannot find a DHCP server.
• stratum : A layer value showing how far away from the reference clock it is. The smaller, the more accurate, and 16 is unsynchronized.
• slew (gradual adjustment) : A method of closing an error by slightly changing the clock speed instead of jumping the time.
• chrony / chronyd : The standard time-sync implementation on modern Linux and its daemon. Strong on unstable networks.
• iburst : An option that sends several quick queries right after startup to speed up synchronization.
• Symbols in chronyc sources : * current reference source / + candidate / ? unreachable / x falseticker.
• server vs pool : Specifies one server / specifies a group of servers for which DNS returns multiple IPs.