DHCP Reservations — Networking

Part 1 · Which MAC

One device has several MAC addresses.

Every network interface has its own MAC. The DHCP server only sees the MAC of the interface that is asking for an address. If the device is set up on Ethernet, the reservation needs the Ethernet MAC.

Example: laptop on a desk MACs are made up

Use this oneEthernet (wired port)3C:52:82:1A:7F:04Asks for the address when the cable is plugged in.

Only on Wi-FiWi-FiA4:C3:F0:5D:21:9BUsed only on Wi-Fi. Phones and laptops often show a random "private" MAC per network.

NeverBluetoothA4:C3:F0:5D:21:9CFor headsets and mice. It never asks DHCP for an IP, but it often looks almost the same as the Wi-Fi MAC.

CheckDock or USB adapter00:E0:4C:68:12:AAHas its own MAC. On a dock, the dock's MAC is the one that asks.

Ethernet port3C:52:82:1A:7F:04 Switchpasses it along DHCP serversees only 3C:52:82:1A:7F:04

Find the right MAC

Plug the device in by Ethernet, on the VLAN it will live on.
Find its lease in the DHCP server's lease list. That MAC is the one to reserve.
Or look up the switch's MAC table for that port.
On Windows, run ipconfig /all and read Physical Address under Ethernet adapter, not Wireless or Bluetooth.
On a label, use the LAN or ETH MAC, not WLAN or BT.

Common mix-ups

Copying the Wi-Fi MAC off a sticker for a device that will be wired.
Reserving a laptop's built-in port when the user works on a dock.
A desk phone with a PC port: the phone and the PC behind it each have their own MAC and their own lease.
One MAC, written three ways: 3C:52:82:1A:7F:04, 3C-52-82-1A-7F-04, 3c52.821a.7f04.

Where to read the MAC on the gear we install

Drawings, not photos. Label layouts change by model, but the MAC is always on the sticker and in the device's own status screen. MACs below use each maker's real prefix with a made-up ending.

UniFi switchSticker on the bottom or side. The MAC is printed as 12 characters with no colons. UniFi Network also shows it on the device's overview.

UniFi access pointSticker on the back, under the mounting plate. Read it before the AP goes on the ceiling, or find it in UniFi Network afterward.

IP desk phone (Yealink shown)Sticker on the back, and Menu › Status on the screen, which also shows the phone's current IP. The PC plugged into the phone has its own, different MAC.

C:\> ipconfig /all

Ethernet adapter Ethernet:
   Description . . . . . . . . . . . : Intel(R) Ethernet Connection I219-LM
   Physical Address. . . . . . . . . : 3C-52-82-1A-7F-04
   DHCP Enabled. . . . . . . . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 10.0.20.112(Preferred)
   Default Gateway . . . . . . . . . : 10.0.20.1
   DHCP Server . . . . . . . . . . . : 10.0.20.1

Wireless LAN adapter Wi-Fi:
   Media State . . . . . . . . . . . : Media disconnected
   Physical Address. . . . . . . . . : A4-C3-F0-5D-21-9B

Ethernet adapter Bluetooth Network Connection:
   Media State . . . . . . . . . . . : Media disconnected
   Physical Address. . . . . . . . . : A4-C3-F0-5D-21-9C

Windows PCRun ipconfig /all. Use the Physical Address under Ethernet adapter Ethernet. Bluetooth also shows up as an "Ethernet adapter", so read the heading, not just the first MAC you see.

Check who made it: OUI lookup

F0:9F:C2:A4:1B:37

First 3 bytes: the OUI, assigned to the maker by the IEEELast 3 bytes: set by the maker for this one device

Look up the first half of any MAC to see who made the interface. It's a quick check that you copied the right one:

Prefix	Maker	So this MAC is probably…
`F0:9F:C2`, `24:5A:4C`	Ubiquiti	A UniFi switch or AP
`AC:CC:8E`, `00:40:8C`	Axis	An Axis IP camera
`80:5E:C0`, `24:9A:D8`	Yealink	A Yealink phone
`00:0B:82`	Grandstream	A Grandstream phone
`3C:52:82`	HP	An HP laptop or desktop's wired port
`A4:C3:F0`	Intel	A laptop's Intel Wi-Fi or Bluetooth chip. Wrong one for a wired reservation.
`00:E0:4C`	Realtek	Often a USB-to-Ethernet adapter or dock

Lookup tools: Wireshark OUI Lookup (paste a whole MAC) and the IEEE registry search (the official list). Prefixes above were checked against Wireshark's list on 21 Oct 2026.

No match? If the second character of the MAC is 2, 6, A or E (for example 3A:… or DE:…), it's a random "private" address that the phone or laptop made up, usually for Wi-Fi. It belongs to no maker and can change, so never reserve it.

Part 2 · Why reserve

Some devices have to stay at one address.

Most laptops and phones don't care which IP they get. A camera, door controller or server is different: other systems store its address. If the address moves, those systems lose the device.

No reservation · parking-lot camera

MondayThe camera gets 10.0.20.45. The NVR records it at .45.
Power outageThe camera is off past its lease, so .45 goes back into the pool.
Next dayA laptop gets .45. The camera comes back as 10.0.20.71.
ResultThe NVR shows the camera offline and stops recording. The ticket says "camera down", but the camera is fine.

Reserved · same camera

SetupReservation: the camera's Ethernet MAC → 10.0.20.45.
Power outageThe server holds .45 for that MAC and gives it to nothing else.
Next dayThe camera asks again and gets 10.0.20.45.
ResultNothing to fix.

Reserve these

Cameras and NVRsDoor and access controllersServers and NASPayment and POS terminalsBuilding systemsAnything in a firewall ruleAnything with a port forward

Rule of thumb: if another system stores this device's IP, reserve it.

Why not just set a static IP on the device?

With a reservation, the DHCP server knows the address is taken and won't give it out. A static IP on the device is invisible to the server and can collide.
Gateway and DNS changes still reach the device when it renews.
Every fixed address for the site is in one list, in one place.

Security: a firewall rule that allows "10.0.20.30 to the payment processor" is only safe if .30 is always the payment terminal. Without a reservation, the rule follows the address, not the device.

Part 3 · Who holds it

The DHCP server holds the reservation. The port and VLAN don't.

The switch port and the VLAN only carry the request. The VLAN decides which subnet, or scope, the request lands in. The reservation itself is a row in the DHCP server's table for that scope: MAC address → IP.

DeviceCameraBroadcasts "I need an address" with its MAC AC:CC:8E:4C:22:10.Knows its own MAC

Switch portPort 14Passes the broadcast along. Any port on the same VLAN works the same way.No reservation

VLAN and gatewayVLAN 20 · 10.0.20.1Sets the subnet. If the server sits elsewhere, the gateway relays the request and marks it "from 10.0.20.1" so the server picks the right scope.No reservation

DHCP serverScope 10.0.20.0/24Looks up the MAC in this scope's reservations.

MAC	Reserved IP
AC:CC:8E:4C:22:10	10.0.20.45
3C:52:82:6B:10:E2	10.0.20.46

Holds the reservation

The DHCP server is whatever hands out addresses on that VLAN. That's often the FortiGate's DHCP server on the VLAN interface, and sometimes a Windows server or another gateway. Make the reservation there, in that VLAN's scope.

The conversation, step by step

Camera → everyone on VLAN 20Discover. "Any DHCP server out there? My MAC is AC:CC:8E:4C:22:10."
Gateway → DHCP serverRelayed. The gateway forwards it, marked "from 10.0.20.1".
DHCP serverPicks scope 10.0.20.0/24 from the relay address, finds the MAC in that scope's reservations: 10.0.20.45.
Server → gateway → cameraOffer. "You can have 10.0.20.45."
Camera → gateway → serverRequest. "I'll take 10.0.20.45."
Server → gateway → cameraAck. "10.0.20.45 is yours," with the gateway, DNS and lease time.

What happens if…

Change	Keeps the reserved IP?	Why
Moved to another port, same VLAN	Yes	Same MAC, same scope. The port doesn't matter.
Moved to a port on a different VLAN	No	The request lands in another scope, which has no reservation for this MAC. The device gets a pool address.
Switched from cable to Wi-Fi	No	Different interface, so a different MAC. Usually a different VLAN too.
Device or network card replaced	No	New MAC. Update the reservation with the new Ethernet MAC.
Laptop moved from its built-in port to a dock	No	The dock's MAC is asking now.
Reservation added while another device holds that IP	Not yet	The server won't take the address back from a current lease. Clear that lease, or wait for it to expire.

After adding a reservation: make the device renew by unplugging and replugging it, or rebooting it. Then confirm in the lease list that it has the reserved IP.

Part 4 · OSI layers

Where each piece sits in the OSI model.

A reservation ties a layer 2 address (the MAC) to a layer 3 address (the IP). The table that does it lives in the DHCP service, at layer 7. Ports and VLANs sit lower down, which is why they never see it.

7ApplicationDHCP itself: Discover, Offer, Request, Ack. The scopes and the reservation table live in this service.

5–6Session, PresentationNothing DHCP-specific here.

4TransportUDP ports 67 and 68. The server listens on 67, the device on 68. A firewall or relay has to allow both.

3NetworkIP address, subnet, gateway. The address being handed out. The DHCP relay on the gateway works here, adding its own IP so the server picks the right scope.

2Data linkMAC address and VLAN. The key the reservation is stored under. Switches forward by MAC and keep traffic inside its VLAN.

1PhysicalCable, switch port, Wi-Fi radio. Just carries the signal. A port has no idea what IP the device should get.

Why the first message needs a relay: a device with no IP yet sends its Discover as a broadcast at layer 2 (to FF:FF:FF:FF:FF:FF) and layer 3 (to 255.255.255.255). Broadcasts stay inside their VLAN. If the DHCP server lives on another VLAN, the gateway's DHCP relay picks the broadcast up and forwards it as a normal message.

Same device, same address. Every time.