GIM Category: dhcp

The DHCP category models events related to the Dynamic Host Configuration Protocol (DHCP), which manages automatic assignment of IP addresses and network configuration parameters. These events describe the interactions between DHCP clients and servers throughout the lease lifecycle — from discovery and offer to renewal and release. Monitoring DHCP activity supports identification of rogue servers, unauthorized hosts, and changes in network topology.

request

Events generated when a DHCP client requests an IP address lease, renewal, or parameter update from a DHCP server. Requests are typically part of the DHCP handshake sequence but can also represent lease renewals or rebindings as part of normal network operation.

gim_event_type_code	gim_event_class	gim_event_category	gim_event_subcategory	gim_event_type	description
290000		dhcp	dhcp.request	dhcp request	A DHCP client issued a request for an IP address lease or renewal.

offer

Events generated when a DHCP server offers an IP address lease to a requesting client. The offer includes network configuration details such as IP address, subnet mask, gateway, and lease duration.

gim_event_type_code	gim_event_class	gim_event_category	gim_event_subcategory	gim_event_type	description
290100		dhcp	dhcp.offer	dhcp offer	A DHCP server issued an offer containing IP configuration parameters for a client.

discovery

Events generated when a DHCP client broadcasts a discovery message to locate available DHCP servers. Discovery events indicate initial attempts to obtain an IP configuration after system startup or network reconnection.

gim_event_type_code	gim_event_class	gim_event_category	gim_event_subcategory	gim_event_type	description
290200		dhcp	dhcp.discovery	dhcp discovery	A DHCP client broadcast a discovery message to locate available DHCP servers.

acknowledgement

Events generated when a DHCP server acknowledges a client’s request, finalizing the assignment of an IP address lease. This message completes the DHCP handshake and allows the client to use the assigned configuration.

gim_event_type_code	gim_event_class	gim_event_category	gim_event_subcategory	gim_event_type	description
290300		dhcp	dhcp.acknowledgement	dhcp acknowledgement	A DHCP server acknowledged a client’s request, confirming the lease assignment.

default

General DHCP-related messages that do not correspond to a specific transaction stage, such as NAK (negative acknowledgment), decline, release, or vendor-specific extensions. These events may indicate configuration changes, protocol errors, or unauthorized DHCP traffic.

gim_event_type_code	gim_event_class	gim_event_category	gim_event_subcategory	gim_event_type	description
299999		dhcp	dhcp.default	dhcp default event	General DHCP-related messages that do not correspond to a specific transaction stage, such as NAK (negative acknowledgment), decline, release, or vendor-specific extensions. These events may indicate configuration changes, protocol errors, or unauthorized DHCP traffic.