Course contents

Chapter 11: IP Services on IOSLesson 3 of 10

APIPA and failed DHCP leases

Why a host shows 169.254.x.x, how to recognise it and how to trace a DHCP failure from the host outward.

Beginner · 7 min read

Technical definition

APIPA (Automatic Private IP Addressing) is how a host gives itself an address in 169.254.0.0/16 when it cannot get one from a DHCP server. It lets devices on the same link talk to each other, but gives no gateway and no internet access.

What happens

  1. The host broadcasts a DHCP Discover and waits.
  2. No server answers in time, so the host picks a random address in 169.254.1.0 to 169.254.254.255.
  3. It sends ARP probes to check nobody else uses it. If someone does, it tries another.
  4. It keeps the address, with mask 255.255.0.0 and no default gateway, and keeps trying DHCP in the background. Windows retries about every 5 minutes.

Two hosts that both fell back to APIPA on the same link can reach each other, but nothing off the link.

Recognising it

Example output · based on Cisco documentation; exact format varies by platform and software version
C:\>ipconfig
Ethernet adapter Ethernet:

   Autoconfiguration IPv4 Address. . : 169.254.88.17
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . :
Example output. The words Autoconfiguration IPv4 Address and the empty Default Gateway line are the signs. On Linux, the address appears with scope link.

Why DHCP failed

Common causes and checks
Common causes and checksCause; Check. Cable or port is down: Link light; show interfaces status on the switch Wrong VLAN on the port: show vlan brief; the port must be in the VLAN the DHCP scope serves DHCP server down or scope full: Server logs; show ip dhcp pool on a Cisco server No relay on the gateway: ip helper-address on the VLAN interface if the server is on another subnet DHCP snooping blocking the server: The port to the server or relay must be trusted Rogue or duplicate DHCP server: Look for an unexpected gateway address on a good clientCauseCheckCable or port is downLink light; show interfaces status on the switchWrong VLAN on the portshow vlan brief; the port must be in the VLAN the DHCP scope servesDHCP server down or scopefullServer logs; show ip dhcp pool on a Cisco serverNo relay on the gatewayip helper-address on the VLAN interface if the server is on another subnetDHCP snooping blocking theserverThe port to the server or relay must be trustedRogue or duplicate DHCPserverLook for an unexpected gateway address on a good client

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Work from the host outward: link, VLAN, relay, server, security features.

Fixing and verifying

ipconfig /release ipconfig /renew ipconfig /all

Windows: release the fallback address, ask again and confirm DHCP Enabled is yes with a lease from the expected server. On Linux use dhclient or NetworkManager instead.

When the renew succeeds the address moves out of 169.254.0.0/16 and a default gateway appears.

Test yourself

Predict · scenario 1

A PC shows 169.254.88.17 with mask 255.255.0.0. What does that tell you?

Predict · scenario 2

Can a host with an APIPA address reach another network?

Predict · scenario 3

PCs in VLAN 20 get 169.254.x.x but VLAN 10 works. The DHCP server is on another subnet. What is the most likely missing setting?

FAQ

Is APIPA the same as link-local?
Yes. 169.254.0.0/16 is the IPv4 link-local range defined in RFC 3927. APIPA is Microsoft's name for the feature that uses it. IPv6 has its own link-local range, fe80::/10.
Can a router forward 169.254.x.x packets?
No. Link-local addresses must not be routed, so they work only on the local segment.
What do I fix when a PC shows 169.254.x.x?
Fix the path to DHCP, not the PC's address: check the cable and port, the VLAN, the DHCP server and scope, the relay address on the gateway, and DHCP snooping on the switch.