IP · XB Field Notes

A default route matches broadly; it does not rescue every failed path

Tue, 14 Sep 2027 00:00:00 +0000

An IPv4 default route is the prefix 0.0.0.0/0: it matches every IPv4 destination, with the least possible specificity. In a selected routing table, a longer matching prefix normally takes precedence. The default is not a procedure that retries whenever a more specific route fails. Routing policy selects relevant tables, and the chosen route describes a forwarding decision rather than promising that the entire round trip will succeed.

When it breaks

A machine without a default can still reach destinations covered by connected or explicit routes. Conversely, adding a default does not prove internet access. The next hop needs to be reachable, forwarding and filtering must permit the traffic, and replies need a return path. A displayed gateway is only one part of that contract; application communication supplies the evidence that the configured path works.

A more specific rejection route wins over a working default. Linux route types such as unreachable intentionally stop forwarding for matching destinations. A failed neighbor lookup through a selected gateway also does not mean the kernel will automatically search for a healthier, less specific path. Static route preference and metrics are not a service-health monitoring or failover system.

Return-path errors are particularly misleading. The client can select the expected gateway and send traffic toward a listening server, yet fail because the server cannot route replies to the client. Repeatedly changing the client’s default may damage working destinations without repairing that missing reverse path. Inspect both directions and the actual source address before attributing every connection timeout to the sender’s gateway.

A route out still needs a route back. Intended source model only. Missing lab prerequisites keep executable acceptance blocked; no retained run is claimed.

Check it quickly

Source review, 2026-10-18: expected results and historical reports below were not rerun; current execution verification remains blocked.

These commands require a documented Linux lab policy permitting nested namespaces and proc mounts. NET_ADMIN and SYS_ADMIN do not override Docker’s built-in AppArmor mount denial. Setup permission failures are not routing results.

Save this as check-default-route.py and run python3 check-default-route.py with Docker. Python 3.11.16 and iproute2 6.1.0 build a client–router–target topology inside one disposable Linux container. NET_ADMIN and SYS_ADMIN support its nested namespaces and temporary proc mount. All interfaces are newly created veth devices, and no port or route is published on the host:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends iproute2=6.1.0-3 iputils-ping=3:20221126-1+deb12u1 nftables=1.0.6-2+deb12u2 tcpdump=4.99.3-1 traceroute=1:2.1.2-1 procps=2:4.0.2-3 && rm -rf /var/lib/apt/lists/*\nCMD ["python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,os,select,signal,subprocess,time

def run(*args,check=True,input=None,timeout=8):
 result=subprocess.run(args,input=input,capture_output=True,text=True,timeout=timeout)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def ns(name,*args,**kwargs):return run('ip','netns','exec',name,*args,**kwargs)
def ip(name,*args,**kwargs):return ns(name,'ip',*args,**kwargs)
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=2)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=2)
def line(process,timeout=3):
 assert select.select([process.stdout],[],[],timeout)[0],'child response deadline exceeded'
 value=process.stdout.readline();assert value,'child exited without a response'
 return value
def spawn(stack,command):
 process=subprocess.Popen(command,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process);return process
@contextmanager
def lab(names):
 with TemporaryDirectory(prefix='net-path-') as directory,ExitStack() as stack:
 root=Path(directory);proc=root/'proc';proc.mkdir();run('mount','-t','proc','proc',str(proc))
 stack.callback(run,'umount',str(proc))
 for name in names:
 run('ip','netns','add',name);stack.callback(run,'ip','netns','delete',name,check=False)
 ip(name,'link','set','lo','up')
 def setting(name,key,value):
 assert name in names
 path=proc/'sys'/key.replace('.','/')
 return ns(name,'python3','-c',f'from pathlib import Path; p=Path({str(path)!r}); p.write_text({str(value)!r}); print(p.read_text().strip())').stdout.strip()
 yield root,stack,setting
def wire(left,left_if,right,right_if,left_addresses,right_addresses):
 run('ip','link','add',left_if,'type','veth','peer','name',right_if)
 for name,interface,addresses in [(left,left_if,left_addresses),(right,right_if,right_addresses)]:
 run('ip','link','set',interface,'netns',name)
 for address in addresses:ip(name,'address','add',address,'dev',interface,*(['nodad'] if ':' in address else []))
 ip(name,'link','set',interface,'up')
def nft(name,script):return ns(name,'nft','-f','-',input=script)
def counters(name):
 data=json.loads(ns(name,'nft','-j','list','ruleset').stdout);found={}
 for entry in data['nftables']:
 rule=entry.get('rule',{})
 if 'comment' in rule:
 for expression in rule['expr']:
 if 'counter' in expression:found[rule['comment']]=expression['counter']['packets']
 return found

def server(stack,name,address,port=18080,label='server'):
 code=r'''
from http.server import BaseHTTPRequestHandler,ThreadingHTTPServer
import json,socket,sys
address,port,label=sys.argv[1],int(sys.argv[2]),sys.argv[3]
class Handler(BaseHTTPRequestHandler):
 def do_GET(self):
 body=json.dumps({'server':label,'peer':self.client_address,'path':self.path}).encode()
 self.send_response(200);self.send_header('Content-Length',str(len(body)));self.end_headers();self.wfile.write(body)
 def log_message(self,*args):pass
class Server(ThreadingHTTPServer):
 address_family=socket.AF_INET6 if ':' in address else socket.AF_INET
 def server_bind(self):
 if self.address_family==socket.AF_INET6:self.socket.setsockopt(socket.IPPROTO_IPV6,socket.IPV6_V6ONLY,1)
 super().server_bind()
service=Server((address,port),Handler);print('ready',flush=True);service.serve_forever()
'''
 process=spawn(stack,['ip','netns','exec',name,'python3','-u','-c',code,address,str(port),label])
 assert line(process).strip()=='ready';return process
def request(name,address,port=18080):
 code=r'''
import http.client,json,sys
client=http.client.HTTPConnection(sys.argv[1],int(sys.argv[2]),timeout=.7)
try:
 client.request('GET','/lab-visible-message');response=client.getresponse();body=json.loads(response.read())
 assert response.status==200;print(json.dumps({'ok':True,'status':response.status,'body':body}))
except OSError as error:print(json.dumps({'ok':False,'type':type(error).__name__,'errno':error.errno}))
finally:client.close()
'''
 return json.loads(ns(name,'python3','-c',code,address,str(port)).stdout)

def routed(setting):
 wire('client','c0','router','r0',['10.201.1.2/30'],['10.201.1.1/30'])
 wire('router','r1','target','t0',['10.201.2.1/30'],['10.201.2.2/30'])
 setting('router','net.ipv4.ip_forward',1)
 ip('client','route','add','default','via','10.201.1.1')
 ip('target','route','add','default','via','10.201.2.1')
with lab(['client','router','target']) as (root,stack,setting):
 routed(setting);ip('client','route','delete','default')
 ip('target','addr','add','198.51.100.9/32','dev','lo');ip('router','route','add','198.51.100.9/32','via','10.201.2.2')
 daemon=server(stack,'target','198.51.100.9')
 connected=ns('client','ping','-n','-c','1','-W','1','10.201.1.1');assert connected.returncode==0
 missing=request('client','198.51.100.9');assert not missing['ok'] and missing['errno']==101
 ip('client','route','add','default','via','10.201.1.1')
 chosen=json.loads(ip('client','-j','route','get','198.51.100.9').stdout)[0];assert chosen['gateway']=='10.201.1.1'
 healthy=request('client','198.51.100.9');assert healthy['ok']
 ip('client','route','add','unreachable','198.51.100.9/32')
 specific=request('client','198.51.100.9');assert not specific['ok'] and specific['errno']==113
 ip('client','route','delete','unreachable','198.51.100.9/32')
 recovered=request('client','198.51.100.9');assert recovered['ok']
 ip('target','route','delete','default')
 bad_return=request('client','198.51.100.9');assert not bad_return['ok'] and bad_return['type']=='TimeoutError'
 assert json.loads(ip('client','-j','route','get','198.51.100.9').stdout)[0]['gateway']=='10.201.1.1'
 ip('target','route','add','default','via','10.201.2.1')
 final=request('client','198.51.100.9');assert final['ok']
 print(json.dumps({'connected_ping_without_default':0,'no_default':missing,'chosen_route':chosen,'with_default':healthy,
 'specific_unreachable_route':specific,'specific_removed':recovered,'missing_return_route':bad_return,'return_route_restored':final}))
"""
name='xbcatm-netpath-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 build=docker('build','-t',name,str(root));assert build.returncode==0,build.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--cap-add','NET_ADMIN','--cap-add','SYS_ADMIN',
 '--memory','256m','--pids-limit','128',name,'python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The client uses 10.201.1.2, with router neighbor 10.201.1.1. The target sits behind the router on another link and owns service address 198.51.100.9 on loopback. The router has a specific route to that service, and the target initially has a return default. The documentation address is used only within this isolated topology; no public server is contacted.

With the client’s default removed, pinging its directly connected router succeeds. An HTTP connection to the remote service fails with Linux ENETUNREACH, errno 101. Adding a default through 10.201.1.1 changes the route lookup to that gateway, and an actual HTTP request returns status 200. This demonstrates both the narrower connectivity that already existed and the additional path enabled by the default.

An unreachable /32 route is then installed for 198.51.100.9. The same connection now fails with EHOSTUNREACH, errno 113, despite the default still being present. Removing that specific route restores HTTP success. The kernel honored the more specific rejection; it did not treat the error as an invitation to fall back to the default gateway.

Next, the script removes only the target’s default route. The client’s lookup still names 10.201.1.1, but a new HTTP attempt reaches its timeout. Restoring the target’s default restores communication. This controlled comparison isolates the return-path dependency while leaving the client’s choice unchanged, providing stronger evidence than a one-sided route listing or an unexplained failed ping.

Inspect the exact flow before editing defaults

Record source address, destination, relevant policy rules, chosen interface, and gateway. A machine with several interfaces or routing tables can make different decisions for different sources, marks, or routing domains. Run diagnostic lookups with the application’s relevant inputs. The fixture uses ordinary destination-based routing and does not claim to reproduce every policy-routing or multipath configuration.

Check the next hop’s link reachability, the router’s forwarding decision, and the target’s route back to the actual source. NAT or a proxy may change which source the target sees. Error classes can guide this work: immediate local network-unreachable errors differ from an explicitly unreachable host route and from a deadline expiring while a reply cannot return. Keep those distinctions in incident evidence.

Defaults are useful because they summarize destinations whose individual routes the host need not know. Configure them deliberately, verify exceptions, and test representative round trips after changes. If automatic failover is required, use a mechanism that observes the relevant path and updates routing appropriately. A second configured gateway or a preferred metric alone does not establish that behavior.

Sources

Linux ip-route(8), default routes, route lookup and unreachable route types, checked 2026-09-12.
RFC 4632 CIDR, longest-prefix matching and route specificity, checked 2026-09-12.
RFC 1812 IPv4 router requirements, IPv4 forwarding and destination reachability, checked 2026-09-12.
Docker AppArmor policy, and built-in profile, mount-policy prerequisite, checked 2026-10-18.

A subnet prefix shapes connected routes; the routing table chooses the path

Mon, 13 Sep 2027 00:00:00 +0000

An IPv4 prefix length says how many leading address bits identify a network. For 192.0.2.5/24, the network is 192.0.2.0/24 and the ordinary broadcast address is 192.0.2.255. Configuring that interface commonly installs a connected route, but the prefix is not the entire routing algorithm. The kernel consults routing policy and route tables to select a path for each destination.

When it breaks

A prefix that is too short can make the host treat remote destinations as directly connected. Keeping address 192.0.2.5 but changing /24 to /16 includes 192.0.3.9 in the connected range. On a real Ethernet segment, that mistaken choice may lead to neighbor resolution for a destination that is not present on the link. An address that looks correct can therefore coexist with a broken next-hop decision.

“Outside my subnet means use the default gateway” is also incomplete. A more specific route can select a different gateway or interface. Within a selected routing table, a longer matching prefix takes precedence over a shorter one. An explicit host route can even override the ordinary connected route for a destination inside the interface’s subnet. Diagnose the actual lookup rather than reconstructing it from the address alone.

Address-count shortcuts need context. An ordinary /24 has network and directed-broadcast addresses that are not usual host assignments, but subtracting two is not universal. RFC 3021 permits both addresses of a /31 point-to-point link as endpoints. A /32 identifies one address. Those cases describe address semantics, not proof that two configured endpoints can exchange packets through the current physical topology.

A longer prefix can override the subnet. Static illustration of the source and its limits. Reported fixture outcomes were not rerun for this graphic.

Check it quickly

Source review, 2026-10-18: expected results and historical reports below were not rerun; current execution verification remains blocked.

Save this as check-subnet.py and run python3 check-subnet.py with Docker. It builds the pinned Python image with iproute2 6.1.0, then grants NET_ADMIN only to a disposable container with no external network attachment. The program creates a dummy interface and changes that container’s routes. It does not alter host interfaces, routes, or a production gateway:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid

recipe='''FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84
RUN apt-get update && apt-get install -y --no-install-recommends iproute2=6.1.0-3 && rm -rf /var/lib/apt/lists/*
'''
program=r'''
from ipaddress import IPv4Address,IPv4Interface,IPv4Network
import json,subprocess
def ip(*args):
 result=subprocess.run(['ip',*args],capture_output=True,text=True,timeout=3)
 assert result.returncode==0,result.stderr
 return result.stdout
def route(address):return json.loads(ip('-j','route','get',address))[0]
interface=IPv4Interface('192.0.2.5/24');network=interface.network
assert str(network.network_address)=='192.0.2.0' and str(network.broadcast_address)=='192.0.2.255'
assert IPv4Address('192.0.2.77') in network and IPv4Address('192.0.3.9') not in network
try:IPv4Network('192.0.2.5/24');raise AssertionError('host bits accepted in strict network')
except ValueError:strict_rejected=True
point_to_point=[str(a) for a in IPv4Network('192.0.2.0/31').hosts()]
assert point_to_point==['192.0.2.0','192.0.2.1']
ip('link','add','lab0','type','dummy');ip('link','set','lab0','up')
ip('address','add','192.0.2.5/24','dev','lab0');ip('route','add','default','via','192.0.2.1','dev','lab0')
ip('route','add','203.0.113.0/24','via','192.0.2.2','dev','lab0')
direct=route('192.0.2.77');specific=route('203.0.113.9');default=route('198.51.100.9');before=route('192.0.3.9')
assert direct['dev']=='lab0' and 'gateway' not in direct
assert specific['gateway']=='192.0.2.2' and default['gateway']==before['gateway']=='192.0.2.1'
ip('route','add','192.0.2.77/32','via','192.0.2.1','dev','lab0');overridden=route('192.0.2.77')
assert overridden['gateway']=='192.0.2.1'
ip('address','del','192.0.2.5/24','dev','lab0');ip('address','add','192.0.2.5/16','dev','lab0')
ip('route','replace','default','via','192.0.2.1','dev','lab0');wrong=route('192.0.3.9')
assert wrong['dev']=='lab0' and 'gateway' not in wrong
print(json.dumps({'interface':str(interface),'network':str(network),'broadcast':str(network.broadcast_address),
 'strict_host_bits_rejected':strict_rejected,'point_to_point_31_hosts':point_to_point,
 'connected':direct,'more_specific_route':specific,'default':default,'host_route_overrides_subnet':overridden,
 'destination_before_widening':before,'destination_after_wrong_16':wrong,'iproute_version':ip('-V').strip()}))
'''
name='xbcatm-subnet-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 build=docker('build','-t',name,str(root));assert build.returncode==0,build.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--cap-add','NET_ADMIN',
 '--memory','128m','--pids-limit','64',name,'python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

Python distinguishes the interface 192.0.2.5/24 from its network 192.0.2.0/24. Strict network parsing rejects the former because host bits are set. The /31 example enumerates both 192.0.2.0 and 192.0.2.1 as usable endpoints. This calculation establishes the address set; the fixture does not configure a working point-to-point link or test forwarding between those two addresses.

The dummy interface receives 192.0.2.5/24 and a default route through 192.0.2.1. A specific route for 203.0.113.0/24 uses 192.0.2.2. Actual ip route get results choose no gateway for 192.0.2.77, gateway 192.0.2.2 for 203.0.113.9, and the default gateway for 198.51.100.9. The output also records the selected interface and preferred source address.

Adding a /32 route for 192.0.2.77 through 192.0.2.1 changes that destination’s lookup to the gateway, despite its membership in the connected /24. This deliberate override demonstrates why subnet membership and final route selection must be kept separate. The selected table has a more specific instruction for that one destination; there is no requirement to rewrite the interface address to express it.

Before widening the interface prefix, 192.0.3.9 uses the default gateway. After replacing /24 with /16 while keeping 192.0.2.5, the lookup selects the dummy interface directly and no longer includes a gateway. The test asserts this change in the real kernel’s decision. It does not claim successful delivery, an observed ARP failure, or a functioning router beyond the dummy interface.

Check the route before changing the mask

Inspect the effective address and prefix, relevant policy rules, and a route lookup for the exact failing destination. On multihomed systems, include the intended source and other policy inputs when reproducing the lookup. A simple destination-only check can differ from the application’s path when source routing, marks, or separate routing domains are in use. Keep the diagnostic context with the result.

On Ethernet, distinguish resolving the destination’s link address from resolving the selected gateway’s link address. A gateway must be reachable according to the configured link and routing rules; a plausible number in a route file is insufficient. Compare actual neighbor state and packet delivery after confirming the route, rather than treating a displayed next hop as proof that forwarding works.

Plan prefix changes with the connected routes and affected destinations they create or remove. Validate representative local, specifically routed, and default-routed traffic after the change. A mask is an input to routing and address interpretation, not an independent reachability promise. This distinction explains both accidental on-link expansion and legitimate exceptions created by more specific routes.

Sources

RFC 4632 CIDR, classless prefixes and longest-match forwarding, checked 2026-09-12.
RFC 3021 point-to-point /31 links, the two usable endpoint addresses of a /31 link, checked 2026-09-12.
Linux ip-route(8), route lookup, next hops and explicit host routes, checked 2026-09-12.
Python 3.11 ipaddress, interface, network and host-address distinctions, checked 2026-09-12.

DHCP lends the address until it expires

Tue, 07 Sep 2027 00:00:00 +0000

Dynamic DHCPv4 allocation lends an address for a lease period. Renewal can extend that period; expiry permits reuse. DHCP also supports other allocation policies, so a finite dynamic lease is the scope of this article, not the only configuration DHCP can deliver.

Borrow a number, not own it

A newly initializing client discovers servers, selects an offer, and requests configuration. The acknowledged lease records how long it may use the address. A lease database tracks assignments, but cannot guarantee that every machine follows the protocol: unmanaged static addresses, overlapping pools, lost server state, or unauthorized servers can still create conflicts. An address assignment is not proof of a device’s identity or a substitute for access control.

Renewal keeps the lease alive

During a finite lease the client normally renews with the original server at T1. If it receives no acknowledgment by T2, it broadcasts a rebinding request that other suitable servers may answer. Defaults are half and seven-eighths of the lease duration; servers may provide different valid timers. RFC 2131 recommends random variation to reduce synchronization. The acknowledgment sets expiry from the renewal request’s send time plus the granted duration. Later T1 and T2 deadlines follow the renewed lease, not the original acquisition.

Renewal often preserves the address but does not guarantee permanent identity across reboots, moves, or policy changes. A shorter lease can reclaim departed clients’ addresses sooner while increasing renewal load; a longer lease gives clients more time to survive an outage but holds unused assignments longer. Fixed-address requirements call for an explicit allocation policy, rather than assuming an arbitrarily long dynamic lease will suffice.

Reclaim what is not used

A client can release an address, but a server must also handle clients that disappear silently. Once the lease expires, the client must stop using the address and restart configuration; the server may allocate it again. A returning device may receive its old address or a different one. Deleting a binding administratively does not revoke a live client’s belief that its lease remains valid, so clearing leases is not a safe substitute for resolving conflicts.

When it breaks

Pool exhaustion may leave a discover unanswered. A NAK has context-specific meaning, such as rejecting an inappropriate requested address; it is not a universal “pool full” response. Some clients configure IPv4 link-local addresses after DHCP failure, but this is separate behavior and does not identify the cause. Check the pool, relay path, and server logs before changing capacity or retries.

Very short leases increase renewal load and reduce outage tolerance. Simultaneous client starts can concentrate traffic, but not every fleet renews in lockstep. Review configured timers and retry behavior instead of treating the default fractions as mandatory tuning values. Lengthening new leases also does not retroactively change already acknowledged leases.

A rogue server can supply an unwanted router or resolver. Selecting the first offer is one possible client policy, not a universal rule. The server-identifier option is not cryptographic authentication and can be spoofed. Network controls such as DHCP snooping must trust the correct switch ports and relay path; merely remembering a server identifier does not establish that trust.

Sleep and clock handling can expose stale configuration. A device waking after expiry must reacquire configuration before resuming use, not blindly keep the address or assume it is merely at T2. Inspect elapsed lease time and implementation logs; wall-clock synchronization alone does not prove correct timer behavior. Conflict detection and DECLINE handling remain separate safeguards.

Finite dynamic leases only. Default T1 and T2 fractions are not universal tuning guarantees. The categorical timeline and renewal formula are explanatory; no DHCP packets or complete client state machine were tested.

Check it quickly

Save this as dhcp_lease_sim.py and run python3 dhcp_lease_sim.py. It uses a virtual clock and a simplified in-memory server. Unicast and broadcast are scenario labels, not transmitted packets; it checks timer arithmetic and address ownership, not a complete DHCP client state machine. Requests and acknowledgments are instantaneous here; T2 is truncated to whole seconds.

"""Simulate a DHCP lease lifecycle on a virtual clock (stdlib only)."""
from __future__ import annotations

LEASE_TIME = 100
T1 = LEASE_TIME // 2 # 50: unicast renewal (RFC 2131 default)
T2 = int(LEASE_TIME * 0.875) # 87: broadcast rebinding (RFC 2131 default)


class DHCPServer:
 def __init__(self, pool):
 self.pool = list(pool)
 self.leases: dict[str, dict] = {} # ip -> {"client": id, "expiry": int}
 self.now = 0

 def _free_ip(self):
 for ip in self.pool:
 lease = self.leases.get(ip)
 if lease is None or lease["expiry"] <= self.now:
 return ip
 return None

 def discover_offer(self, client_id):
 """DISCOVER -> OFFER (no state change)."""
 ip = self._free_ip()
 assert ip is not None, f"t={self.now}: pool exhausted, no OFFER for {client_id}"
 return ip

 def request_ack(self, client_id, ip):
 """REQUEST -> ACK and bind the lease."""
 assert ip in self.pool, "requested address outside pool"
 lease = self.leases.get(ip)
 assert lease is None or lease["expiry"] <= self.now or lease["client"] == client_id, \
 f"t={self.now}: {ip} held by another client"
 self.leases[ip] = {"client": client_id, "expiry": self.now + LEASE_TIME}
 return {"ip": ip, "lease_time": LEASE_TIME, "t1": T1, "t2": T2,
 "expiry": self.now + LEASE_TIME}

 def renew(self, client_id, ip):
 """Extend a current lease; transport and client states are not modeled."""
 lease = self.leases.get(ip)
 if lease is None or lease["client"] != client_id or lease["expiry"] <= self.now:
 return False # expired: server already reclaimed
 lease["expiry"] = self.now + LEASE_TIME
 return True

 def tick(self, dt):
 self.now += dt
 # Reclaim expired leases so a new client can reuse them.
 for ip, lease in list(self.leases.items()):
 if lease["expiry"] <= self.now:
 del self.leases[ip]


def check(cond, msg):
 assert cond, msg


def main():
 server = DHCPServer(["192.168.1.10", "192.168.1.11"])
 # 1. DORA: client c1 joins.
 offered = server.discover_offer("c1")
 check(offered == "192.168.1.10", f"expected first free IP, got {offered}")
 ack = server.request_ack("c1", offered)
 check((ack["lease_time"], ack["t1"], ack["t2"]) == (100, 50, 87), f"bad timers: {ack}")
 check(ack["expiry"] == 100, f"expiry should be 0+100, got {ack['expiry']}")
 print(f"t={server.now}: c1 ACK {ack['ip']} lease=100 T1=50 T2=87 expiry=100")
 # 2. T1 unicast renewal at half lease.
 server.tick(T1) # now=50
 check(server.renew("c1", offered), "T1 renewal should be ACKed")
 check(server.leases[offered]["expiry"] == 150, "T1 must extend expiry to 50+100")
 print(f"t={server.now}: c1 T1 unicast renew OK expiry=150")
 # 3. Miss T1, rebind at T2 via broadcast.
 server.tick(T1) # now=100: renewed T1; pretend this attempt got no ACK
 server.tick(T2 - T1) # now=137: renewed T2, before expiry 150
 check(server.now == 50 + T2, "rebind must use renewed lease origin")
 check(server.renew("c1", offered), "T2 rebinding should be ACKed")
 check(server.leases[offered]["expiry"] == 237, "T2 must extend expiry to 137+100")
 print(f"t={server.now}: c1 T2 broadcast rebind OK expiry=237")
 # 4. Leave without renewing: expiry reclaims the address.
 server.tick(200) # now=337 > expiry 237
 check(offered not in server.leases, "expired lease must be reclaimed")
 offered2 = server.discover_offer("c2")
 check(offered2 == offered, f"reclaimed {offered} should be reused, got {offered2}")
 ack2 = server.request_ack("c2", offered2)
 check(ack2["expiry"] == server.now + LEASE_TIME, "new lease expiry must restart")
 # Stale renewal from the departed client must fail.
 check(not server.renew("c1", offered), "stale renewal after expiry must not be ACKed")
 print(f"t={server.now}: c1 expired, c2 ACK {ack2['ip']} expiry={ack2['expiry']}")
 print("PASS: discover/offer/request/ack, T1 renew, T2 rebind, expiry reclaim")


if __name__ == "__main__":
 main()

The script asserts the first free address is offered, the ACK carries a 100-second lease with T1 at 50 and T2 at 87, each renewal resets expiry to the renewal time plus the lease duration, and the departed address is reclaimed for a second client while the stale renewal fails. Expect four timestamped lines plus a PASS line covering offer, renewal, rebinding, and reclaim.

An earlier version recorded a Python 3.12/macOS pass, but labeled a request at time 107 as T2 even though the renewed T2 was 137. The corrected sequence passes on Python 3.12.14: times 0, 50, 137, and 337, with renewed expiry 237. A real daemon still requires packet, pool, and client-expiry checks.

Sources

IETF: RFC 2131 DHCP, the authoritative lease lifecycle: DISCOVER, OFFER, REQUEST, ACK with T1 and T2 renewal timers, checked 2026-10-19.
ISC: ISC DHCP, legacy implementation resources and the vendor’s end-of-maintenance notice, checked 2026-10-19.
Wikipedia: Dynamic Host Configuration Protocol, a readable overview of the lease lifecycle, checked 2026-10-19.

IP · XB Field Notes

A default route matches broadly; it does not rescue every failed path

When it breaks

Check it quickly

Inspect the exact flow before editing defaults

Sources

A subnet prefix shapes connected routes; the routing table chooses the path

When it breaks

Check it quickly

Check the route before changing the mask

Sources

DHCP lends the address until it expires

Borrow a number, not own it

Renewal keeps the lease alive

Reclaim what is not used

When it breaks

Check it quickly

Further reading

Sources