Ip · XB Field Notes

A default route matches broadly; it does not rescue every failed path

Tue, 14 Sep 2027 00:00:00 +0000

An IPv4 default route is the prefix 0.0.0.0/0: it matches every IPv4 destination, with the least possible specificity. In a selected routing table, a longer matching prefix normally takes precedence. The default is not a procedure that retries whenever a more specific route fails. Routing policy selects relevant tables, and the chosen route describes a forwarding decision rather than promising that the entire round trip will succeed.

When it breaks

A machine without a default can still reach destinations covered by connected or explicit routes. Conversely, adding a default does not prove internet access. The next hop needs to be reachable, forwarding and filtering must permit the traffic, and replies need a return path. A displayed gateway is only one part of that contract; application communication supplies the evidence that the configured path works.

A more specific rejection route wins over a working default. Linux route types such as unreachable intentionally stop forwarding for matching destinations. A failed neighbor lookup through a selected gateway also does not mean the kernel will automatically search for a healthier, less specific path. Static route preference and metrics are not a service-health monitoring or failover system.

Return-path errors are particularly misleading. The client can select the expected gateway and send traffic toward a listening server, yet fail because the server cannot route replies to the client. Repeatedly changing the client’s default may damage working destinations without repairing that missing reverse path. Inspect both directions and the actual source address before attributing every connection timeout to the sender’s gateway.

Check it quickly

Save this as check-default-route.py and run python3 check-default-route.py with Docker. Python 3.11.16 and iproute2 6.1.0 build a client–router–target topology inside one disposable Linux container. NET_ADMIN and SYS_ADMIN support its nested namespaces and temporary proc mount. All interfaces are newly created veth devices, and no port or route is published on the host:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid
recipe='FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84\nRUN apt-get update && apt-get install -y --no-install-recommends iproute2=6.1.0-3 iputils-ping=3:20221126-1+deb12u1 nftables=1.0.6-2+deb12u2 tcpdump=4.99.3-1 traceroute=1:2.1.2-1 procps=2:4.0.2-3 && rm -rf /var/lib/apt/lists/*\nCMD ["python3"]\n'
program=r"""
from contextlib import ExitStack,contextmanager
from pathlib import Path
from tempfile import TemporaryDirectory
import json,os,select,signal,subprocess,time

def run(*args,check=True,input=None,timeout=8):
 result=subprocess.run(args,input=input,capture_output=True,text=True,timeout=timeout)
 if check:assert result.returncode==0,(args,result.returncode,result.stdout,result.stderr)
 return result
def ns(name,*args,**kwargs):return run('ip','netns','exec',name,*args,**kwargs)
def ip(name,*args,**kwargs):return ns(name,'ip',*args,**kwargs)
def stop(process):
 if process.poll() is None:
 process.terminate()
 try:process.wait(timeout=2)
 except subprocess.TimeoutExpired:process.kill();process.wait(timeout=2)
def line(process,timeout=3):
 assert select.select([process.stdout],[],[],timeout)[0],'child response deadline exceeded'
 value=process.stdout.readline();assert value,'child exited without a response'
 return value
def spawn(stack,command):
 process=subprocess.Popen(command,stdin=subprocess.PIPE,stdout=subprocess.PIPE,stderr=subprocess.PIPE,text=True)
 stack.callback(stop,process);return process
@contextmanager
def lab(names):
 with TemporaryDirectory(prefix='net-path-') as directory,ExitStack() as stack:
 root=Path(directory);proc=root/'proc';proc.mkdir();run('mount','-t','proc','proc',str(proc))
 stack.callback(run,'umount',str(proc))
 for name in names:
 run('ip','netns','add',name);stack.callback(run,'ip','netns','delete',name,check=False)
 ip(name,'link','set','lo','up')
 def setting(name,key,value):
 assert name in names
 path=proc/'sys'/key.replace('.','/')
 return ns(name,'python3','-c',f'from pathlib import Path; p=Path({str(path)!r}); p.write_text({str(value)!r}); print(p.read_text().strip())').stdout.strip()
 yield root,stack,setting
def wire(left,left_if,right,right_if,left_addresses,right_addresses):
 run('ip','link','add',left_if,'type','veth','peer','name',right_if)
 for name,interface,addresses in [(left,left_if,left_addresses),(right,right_if,right_addresses)]:
 run('ip','link','set',interface,'netns',name)
 for address in addresses:ip(name,'address','add',address,'dev',interface,*(['nodad'] if ':' in address else []))
 ip(name,'link','set',interface,'up')
def nft(name,script):return ns(name,'nft','-f','-',input=script)
def counters(name):
 data=json.loads(ns(name,'nft','-j','list','ruleset').stdout);found={}
 for entry in data['nftables']:
 rule=entry.get('rule',{})
 if 'comment' in rule:
 for expression in rule['expr']:
 if 'counter' in expression:found[rule['comment']]=expression['counter']['packets']
 return found

def server(stack,name,address,port=18080,label='server'):
 code=r'''
from http.server import BaseHTTPRequestHandler,ThreadingHTTPServer
import json,socket,sys
address,port,label=sys.argv[1],int(sys.argv[2]),sys.argv[3]
class Handler(BaseHTTPRequestHandler):
 def do_GET(self):
 body=json.dumps({'server':label,'peer':self.client_address,'path':self.path}).encode()
 self.send_response(200);self.send_header('Content-Length',str(len(body)));self.end_headers();self.wfile.write(body)
 def log_message(self,*args):pass
class Server(ThreadingHTTPServer):
 address_family=socket.AF_INET6 if ':' in address else socket.AF_INET
 def server_bind(self):
 if self.address_family==socket.AF_INET6:self.socket.setsockopt(socket.IPPROTO_IPV6,socket.IPV6_V6ONLY,1)
 super().server_bind()
service=Server((address,port),Handler);print('ready',flush=True);service.serve_forever()
'''
 process=spawn(stack,['ip','netns','exec',name,'python3','-u','-c',code,address,str(port),label])
 assert line(process).strip()=='ready';return process
def request(name,address,port=18080):
 code=r'''
import http.client,json,sys
client=http.client.HTTPConnection(sys.argv[1],int(sys.argv[2]),timeout=.7)
try:
 client.request('GET','/lab-visible-message');response=client.getresponse();body=json.loads(response.read())
 assert response.status==200;print(json.dumps({'ok':True,'status':response.status,'body':body}))
except OSError as error:print(json.dumps({'ok':False,'type':type(error).__name__,'errno':error.errno}))
finally:client.close()
'''
 return json.loads(ns(name,'python3','-c',code,address,str(port)).stdout)

def routed(setting):
 wire('client','c0','router','r0',['10.201.1.2/30'],['10.201.1.1/30'])
 wire('router','r1','target','t0',['10.201.2.1/30'],['10.201.2.2/30'])
 setting('router','net.ipv4.ip_forward',1)
 ip('client','route','add','default','via','10.201.1.1')
 ip('target','route','add','default','via','10.201.2.1')
with lab(['client','router','target']) as (root,stack,setting):
 routed(setting);ip('client','route','delete','default')
 ip('target','addr','add','198.51.100.9/32','dev','lo');ip('router','route','add','198.51.100.9/32','via','10.201.2.2')
 daemon=server(stack,'target','198.51.100.9')
 connected=ns('client','ping','-n','-c','1','-W','1','10.201.1.1');assert connected.returncode==0
 missing=request('client','198.51.100.9');assert not missing['ok'] and missing['errno']==101
 ip('client','route','add','default','via','10.201.1.1')
 chosen=json.loads(ip('client','-j','route','get','198.51.100.9').stdout)[0];assert chosen['gateway']=='10.201.1.1'
 healthy=request('client','198.51.100.9');assert healthy['ok']
 ip('client','route','add','unreachable','198.51.100.9/32')
 specific=request('client','198.51.100.9');assert not specific['ok'] and specific['errno']==113
 ip('client','route','delete','unreachable','198.51.100.9/32')
 recovered=request('client','198.51.100.9');assert recovered['ok']
 ip('target','route','delete','default')
 bad_return=request('client','198.51.100.9');assert not bad_return['ok'] and bad_return['type']=='TimeoutError'
 assert json.loads(ip('client','-j','route','get','198.51.100.9').stdout)[0]['gateway']=='10.201.1.1'
 ip('target','route','add','default','via','10.201.2.1')
 final=request('client','198.51.100.9');assert final['ok']
 print(json.dumps({'connected_ping_without_default':0,'no_default':missing,'chosen_route':chosen,'with_default':healthy,
 'specific_unreachable_route':specific,'specific_removed':recovered,'missing_return_route':bad_return,'return_route_restored':final}))
"""
name='xbcatm-netpath-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 build=docker('build','-t',name,str(root));assert build.returncode==0,build.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--cap-add','NET_ADMIN','--cap-add','SYS_ADMIN',
 '--memory','256m','--pids-limit','128',name,'python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

The client uses 10.201.1.2, with router neighbor 10.201.1.1. The target sits behind the router on another link and owns service address 198.51.100.9 on loopback. The router has a specific route to that service, and the target initially has a return default. The documentation address is used only within this isolated topology; no public server is contacted.

With the client’s default removed, pinging its directly connected router succeeds. An HTTP connection to the remote service fails with Linux ENETUNREACH, errno 101. Adding a default through 10.201.1.1 changes the route lookup to that gateway, and an actual HTTP request returns status 200. This demonstrates both the narrower connectivity that already existed and the additional path enabled by the default.

An unreachable /32 route is then installed for 198.51.100.9. The same connection now fails with EHOSTUNREACH, errno 113, despite the default still being present. Removing that specific route restores HTTP success. The kernel honored the more specific rejection; it did not treat the error as an invitation to fall back to the default gateway.

Next, the script removes only the target’s default route. The client’s lookup still names 10.201.1.1, but a new HTTP attempt reaches its timeout. Restoring the target’s default restores communication. This controlled comparison isolates the return-path dependency while leaving the client’s choice unchanged, providing stronger evidence than a one-sided route listing or an unexplained failed ping.

Inspect the exact flow before editing defaults

Record source address, destination, relevant policy rules, chosen interface, and gateway. A machine with several interfaces or routing tables can make different decisions for different sources, marks, or routing domains. Run diagnostic lookups with the application’s relevant inputs. The fixture uses ordinary destination-based routing and does not claim to reproduce every policy-routing or multipath configuration.

Check the next hop’s link reachability, the router’s forwarding decision, and the target’s route back to the actual source. NAT or a proxy may change which source the target sees. Error classes can guide this work: immediate local network-unreachable errors differ from an explicitly unreachable host route and from a deadline expiring while a reply cannot return. Keep those distinctions in incident evidence.

Defaults are useful because they summarize destinations whose individual routes the host need not know. Configure them deliberately, verify exceptions, and test representative round trips after changes. If automatic failover is required, use a mechanism that observes the relevant path and updates routing appropriately. A second configured gateway or a preferred metric alone does not establish that behavior.

Sources

Linux ip-route(8), default routes, route lookup and unreachable route types, checked 2026-09-12.
RFC 4632 CIDR, longest-prefix matching and route specificity, checked 2026-09-12.
RFC 1812 IPv4 router requirements, IPv4 forwarding and destination reachability, checked 2026-09-12.

A subnet prefix shapes connected routes; the routing table chooses the path

Mon, 13 Sep 2027 00:00:00 +0000

An IPv4 prefix length says how many leading address bits identify a network. For 192.0.2.5/24, the network is 192.0.2.0/24 and the ordinary broadcast address is 192.0.2.255. Configuring that interface commonly installs a connected route, but the prefix is not the entire routing algorithm. The kernel consults routing policy and route tables to select a path for each destination.

When it breaks

A prefix that is too short can make the host treat remote destinations as directly connected. Keeping address 192.0.2.5 but changing /24 to /16 includes 192.0.3.9 in the connected range. On a real Ethernet segment, that mistaken choice may lead to neighbor resolution for a destination that is not present on the link. An address that looks correct can therefore coexist with a broken next-hop decision.

“Outside my subnet means use the default gateway” is also incomplete. A more specific route can select a different gateway or interface. Within a selected routing table, a longer matching prefix takes precedence over a shorter one. An explicit host route can even override the ordinary connected route for a destination inside the interface’s subnet. Diagnose the actual lookup rather than reconstructing it from the address alone.

Address-count shortcuts need context. An ordinary /24 has network and directed-broadcast addresses that are not usual host assignments, but subtracting two is not universal. RFC 3021 permits both addresses of a /31 point-to-point link as endpoints. A /32 identifies one address. Those cases describe address semantics, not proof that two configured endpoints can exchange packets through the current physical topology.

Check it quickly

Save this as check-subnet.py and run python3 check-subnet.py with Docker. It builds the pinned Python image with iproute2 6.1.0, then grants NET_ADMIN only to a disposable container with no external network attachment. The program creates a dummy interface and changes that container’s routes. It does not alter host interfaces, routes, or a production gateway:

from pathlib import Path
from tempfile import TemporaryDirectory
import json,subprocess,uuid

recipe='''FROM python@sha256:528257d48c1da0dcecc2e725d1ae34498d60c965f1241e39cd6a85a8859bdf84
RUN apt-get update && apt-get install -y --no-install-recommends iproute2=6.1.0-3 && rm -rf /var/lib/apt/lists/*
'''
program=r'''
from ipaddress import IPv4Address,IPv4Interface,IPv4Network
import json,subprocess
def ip(*args):
 result=subprocess.run(['ip',*args],capture_output=True,text=True,timeout=3)
 assert result.returncode==0,result.stderr
 return result.stdout
def route(address):return json.loads(ip('-j','route','get',address))[0]
interface=IPv4Interface('192.0.2.5/24');network=interface.network
assert str(network.network_address)=='192.0.2.0' and str(network.broadcast_address)=='192.0.2.255'
assert IPv4Address('192.0.2.77') in network and IPv4Address('192.0.3.9') not in network
try:IPv4Network('192.0.2.5/24');raise AssertionError('host bits accepted in strict network')
except ValueError:strict_rejected=True
point_to_point=[str(a) for a in IPv4Network('192.0.2.0/31').hosts()]
assert point_to_point==['192.0.2.0','192.0.2.1']
ip('link','add','lab0','type','dummy');ip('link','set','lab0','up')
ip('address','add','192.0.2.5/24','dev','lab0');ip('route','add','default','via','192.0.2.1','dev','lab0')
ip('route','add','203.0.113.0/24','via','192.0.2.2','dev','lab0')
direct=route('192.0.2.77');specific=route('203.0.113.9');default=route('198.51.100.9');before=route('192.0.3.9')
assert direct['dev']=='lab0' and 'gateway' not in direct
assert specific['gateway']=='192.0.2.2' and default['gateway']==before['gateway']=='192.0.2.1'
ip('route','add','192.0.2.77/32','via','192.0.2.1','dev','lab0');overridden=route('192.0.2.77')
assert overridden['gateway']=='192.0.2.1'
ip('address','del','192.0.2.5/24','dev','lab0');ip('address','add','192.0.2.5/16','dev','lab0')
ip('route','replace','default','via','192.0.2.1','dev','lab0');wrong=route('192.0.3.9')
assert wrong['dev']=='lab0' and 'gateway' not in wrong
print(json.dumps({'interface':str(interface),'network':str(network),'broadcast':str(network.broadcast_address),
 'strict_host_bits_rejected':strict_rejected,'point_to_point_31_hosts':point_to_point,
 'connected':direct,'more_specific_route':specific,'default':default,'host_route_overrides_subnet':overridden,
 'destination_before_widening':before,'destination_after_wrong_16':wrong,'iproute_version':ip('-V').strip()}))
'''
name='xbcatm-subnet-'+uuid.uuid4().hex[:10]
def docker(*args,**kwargs):return subprocess.run(['docker',*args],capture_output=True,text=True,timeout=300,**kwargs)
try:
 with TemporaryDirectory(prefix=name+'-') as directory:
 root=Path(directory);(root/'Dockerfile').write_text(recipe)
 build=docker('build','-t',name,str(root));assert build.returncode==0,build.stderr
 result=docker('run','--rm','-i','--name',name,'--network','none','--cap-add','NET_ADMIN',
 '--memory','128m','--pids-limit','64',name,'python3','-',input=program)
 assert result.returncode==0,result.stderr
 print(json.dumps(json.loads(result.stdout),sort_keys=True))
finally:
 docker('rm','-f',name);docker('image','rm',name)

Python distinguishes the interface 192.0.2.5/24 from its network 192.0.2.0/24. Strict network parsing rejects the former because host bits are set. The /31 example enumerates both 192.0.2.0 and 192.0.2.1 as usable endpoints. This calculation establishes the address set; the fixture does not configure a working point-to-point link or test forwarding between those two addresses.

The dummy interface receives 192.0.2.5/24 and a default route through 192.0.2.1. A specific route for 203.0.113.0/24 uses 192.0.2.2. Actual ip route get results choose no gateway for 192.0.2.77, gateway 192.0.2.2 for 203.0.113.9, and the default gateway for 198.51.100.9. The output also records the selected interface and preferred source address.

Adding a /32 route for 192.0.2.77 through 192.0.2.1 changes that destination’s lookup to the gateway, despite its membership in the connected /24. This deliberate override demonstrates why subnet membership and final route selection must be kept separate. The selected table has a more specific instruction for that one destination; there is no requirement to rewrite the interface address to express it.

Before widening the interface prefix, 192.0.3.9 uses the default gateway. After replacing /24 with /16 while keeping 192.0.2.5, the lookup selects the dummy interface directly and no longer includes a gateway. The test asserts this change in the real kernel’s decision. It does not claim successful delivery, an observed ARP failure, or a functioning router beyond the dummy interface.

Check the route before changing the mask

Inspect the effective address and prefix, relevant policy rules, and a route lookup for the exact failing destination. On multihomed systems, include the intended source and other policy inputs when reproducing the lookup. A simple destination-only check can differ from the application’s path when source routing, marks, or separate routing domains are in use. Keep the diagnostic context with the result.

On Ethernet, distinguish resolving the destination’s link address from resolving the selected gateway’s link address. A gateway must be reachable according to the configured link and routing rules; a plausible number in a route file is insufficient. Compare actual neighbor state and packet delivery after confirming the route, rather than treating a displayed next hop as proof that forwarding works.

Plan prefix changes with the connected routes and affected destinations they create or remove. Validate representative local, specifically routed, and default-routed traffic after the change. A mask is an input to routing and address interpretation, not an independent reachability promise. This distinction explains both accidental on-link expansion and legitimate exceptions created by more specific routes.

Sources

RFC 4632 CIDR, classless prefixes and longest-match forwarding, checked 2026-09-12.
RFC 3021 point-to-point /31 links, the two usable endpoint addresses of a /31 link, checked 2026-09-12.
Linux ip-route(8), route lookup, next hops and explicit host routes, checked 2026-09-12.
Python 3.11 ipaddress, interface, network and host-address distinctions, checked 2026-09-12.

DHCP lends the address until it expires

Tue, 07 Sep 2027 00:00:00 +0000

DHCP hands out leases with a duration, not perpetual ownership. The lifetime drives renewal and lets the server reclaim addresses the device no longer uses.

Borrow a number, not own it

DHCP does not give a device a permanent address; it lends one for a bounded time. On joining, a client broadcasts to discover a server, and the server offers an address with a lease lifetime defined by the network’s configured lease time. Because the assignment is temporary, the server always knows which addresses are valid and can track them in a pool without guessing. That temporary nature is what makes a large, frequently-changing network manageable: addresses are currency the server can hand out, extend, and take back, rather than addresses a host keeps forever.

Renewal keeps the lease alive

Before the lease expires, the client asks to renew it — first at roughly half the lease interval, again if needed — so a healthy device keeps the same address indefinitely without human intervention. This half-life renewal keeps the address stable across reboots and sessions, which matters for things like voice and some VPN clients that would be disrupted by an address change. The configured lease time is a governance knob: a shorter lease recycles addresses faster but forces more renewal traffic; a longer one keeps addresses stable longer but ties up numbers on devices that left long ago.

Reclaim what is not used

When a lease expires without renewal, the server reclaims the address and can hand it to another host. That is how a laptop that left the building days ago stops holding an address a new device needs. A client that abandoned a lease gets a new address on its next join — fine for transient use, hostile to services that expect a fixed identity. Tuning the lease balances churn against availability: short leases for a crowded or transient network, long ones for a stable internal pool where identifiers matter.

When it breaks

Exhaustion looks like silence. With no free address, a new DISCOVER gets no OFFER or its REQUEST draws a NAK, and the laptop falls back to a 169.254.x.x link-local address. Fix capacity, not retries: enlarge the pool, shorten leases on transient networks, and clear bindings flagged as abandoned after conflicts.

The opposite error is a lease so short it becomes a storm. A five-minute lease in a large office drives half the fleet through T1 renewal every few minutes, with stragglers rebroadcasting at T2, so any server restart meets a synchronized flood. Keep the RFC 2131 defaults of T1 at half and T2 at seven-eighths, lengthen the lease first, and stagger booting clients.

A rogue server wins by answering first. A stray router or malicious host offers a plausible address with the wrong gateway or DNS and steers traffic through itself. Symptoms wander: some leases work, resolution looks strange, and the victims change with each race. Pin the legitimate server identifier, enable DHCP snooping so only trusted ports may answer, and remove the intruder.

Clock skew breaks the quiet contract. Lifetimes travel as relative seconds, but absolute expiry timestamps or a laptop asleep past T1 and T2 can expire early or hold too long. The sleeper wakes still configured with an address the server already gave to someone else. Treat long sleep as a rebind, watch NTP alongside DHCP logs, and keep conflict detection with DECLINE and RELEASE handling.

Check it quickly

Save the following as dhcp_lease_sim.py and run python3 dhcp_lease_sim.py. It uses only the standard library and a virtual clock with no network, and models DISCOVER, OFFER, REQUEST, and ACK with T1 unicast renewal and T2 broadcast rebinding.

"""Simulate a DHCP lease lifecycle on a virtual clock (stdlib only)."""
from __future__ import annotations

LEASE_TIME = 100
T1 = LEASE_TIME // 2 # 50: unicast renewal (RFC 2131 default)
T2 = int(LEASE_TIME * 0.875) # 87: broadcast rebinding (RFC 2131 default)


class DHCPServer:
 def __init__(self, pool):
 self.pool = list(pool)
 self.leases: dict[str, dict] = {} # ip -> {"client": id, "expiry": int}
 self.now = 0

 def _free_ip(self):
 for ip in self.pool:
 lease = self.leases.get(ip)
 if lease is None or lease["expiry"] <= self.now:
 return ip
 return None

 def discover_offer(self, client_id):
 """DISCOVER -> OFFER (no state change)."""
 ip = self._free_ip()
 assert ip is not None, f"t={self.now}: pool exhausted, no OFFER for {client_id}"
 return ip

 def request_ack(self, client_id, ip):
 """REQUEST -> ACK and bind the lease."""
 lease = self.leases.get(ip)
 assert lease is None or lease["expiry"] <= self.now or lease["client"] == client_id, \
 f"t={self.now}: {ip} held by another client"
 self.leases[ip] = {"client": client_id, "expiry": self.now + LEASE_TIME}
 return {"ip": ip, "lease_time": LEASE_TIME, "t1": T1, "t2": T2,
 "expiry": self.now + LEASE_TIME}

 def renew(self, client_id, ip, broadcast=False):
 """Renew at T1 (unicast) or T2 (broadcast). Returns True on ACK."""
 lease = self.leases.get(ip)
 if lease is None or lease["client"] != client_id or lease["expiry"] <= self.now:
 return False # expired: server already reclaimed
 lease["expiry"] = self.now + LEASE_TIME
 return True

 def tick(self, dt):
 self.now += dt
 # Reclaim expired leases so a new client can reuse them.
 for ip, lease in list(self.leases.items()):
 if lease["expiry"] <= self.now:
 del self.leases[ip]


def check(cond, msg):
 assert cond, msg


def main():
 server = DHCPServer(["192.168.1.10", "192.168.1.11"])
 # 1. DORA: client c1 joins.
 offered = server.discover_offer("c1")
 check(offered == "192.168.1.10", f"expected first free IP, got {offered}")
 ack = server.request_ack("c1", offered)
 check((ack["lease_time"], ack["t1"], ack["t2"]) == (100, 50, 87), f"bad timers: {ack}")
 check(ack["expiry"] == 100, f"expiry should be 0+100, got {ack['expiry']}")
 print(f"t={server.now}: c1 ACK {ack['ip']} lease=100 T1=50 T2=87 expiry=100")
 # 2. T1 unicast renewal at half lease.
 server.tick(T1) # now=50
 check(server.renew("c1", offered), "T1 renewal should be ACKed")
 check(server.leases[offered]["expiry"] == 150, "T1 must extend expiry to 50+100")
 print(f"t={server.now}: c1 T1 unicast renew OK expiry=150")
 # 3. Miss T1, rebind at T2 via broadcast.
 server.tick(T2 - T1) # now=87; T1 of current lease would be 100
 server.tick(20) # now=107: past T1 (100), before T2 (137) and expiry (150)
 check(server.renew("c1", offered, broadcast=True), "T2 rebinding should be ACKed")
 check(server.leases[offered]["expiry"] == 207, "T2 must extend expiry to 107+100")
 print(f"t={server.now}: c1 T2 broadcast rebind OK expiry=207")
 # 4. Leave without renewing: expiry reclaims the address.
 server.tick(200) # now=307 > expiry 207
 check(offered not in server.leases, "expired lease must be reclaimed")
 offered2 = server.discover_offer("c2")
 check(offered2 == offered, f"reclaimed {offered} should be reused, got {offered2}")
 ack2 = server.request_ack("c2", offered2)
 check(ack2["expiry"] == server.now + LEASE_TIME, "new lease expiry must restart")
 # Stale renewal from the departed client must fail.
 check(not server.renew("c1", offered), "stale renewal after expiry must not be ACKed")
 print(f"t={server.now}: c1 expired, c2 ACK {ack2['ip']} expiry={ack2['expiry']}")
 print("PASS: discover/offer/request/ack, T1 renew, T2 rebind, expiry reclaim")


if __name__ == "__main__":
 main()

The script asserts the first free address is offered, the ACK carries a 100-second lease with T1 at 50 and T2 at 87, each renewal extends expiry by a full lease, and the departed address is reclaimed for a second client while the stale renewal fails. Expect four timestamped lines plus a PASS line covering offer, renewal, rebinding, and reclaim.

The assertions passed with Python 3.12 on macOS. The virtual clock proves the state machine, not a production daemon: still verify the real server’s lease time, pool size, authorized server list, and NTP health.

Sources

IETF: RFC 2131 DHCP, the authoritative lease lifecycle: DISCOVER, OFFER, REQUEST, ACK with T1 and T2 renewal timers, checked 2027-08-15.
ISC: ISC DHCP, pool management, lease database, and server operation notes, checked 2027-08-15.
Wikipedia: Dynamic Host Configuration Protocol, a readable overview of the lease lifecycle, checked 2027-08-15.

Ip · XB Field Notes

A default route matches broadly; it does not rescue every failed path

When it breaks

Check it quickly

Inspect the exact flow before editing defaults

Sources

A subnet prefix shapes connected routes; the routing table chooses the path

When it breaks

Check it quickly

Check the route before changing the mask

Sources

DHCP lends the address until it expires

Borrow a number, not own it

Renewal keeps the lease alive

Reclaim what is not used

When it breaks

Check it quickly

Further reading

Sources