Although can do everything from the command line, there are cases
where  it’s  just  easier  to do it once in a configuration file.
Most of the options found in can be used here.  The first word on
the line is the option and the rest of the  line  is  the  value.
Leading  and  trailing  whitespace  for  the option and value are
trimmed.  You can escape characters in  the  value  using  the  \
character.   Comments  can  be  prefixed  with  the  # character.
String values should be quoted with the "  character.   Here’s  a
list  of  available options: When discovering interfaces, the in‐
terface name must match which is a space or comma separated  list
of patterns passed to If the same interface is matched in then it
is still denied.  When discovering interfaces, the interface name
must  not  match which is a space or comma separated list of pat‐
terns passed to Enables Anonymity Profiles for  DHCP,  RFC  7844.
Any  DUID is ignored and ClientID is set to LL only.  All non es‐
sential options are then masked at this point, but they could  be
unmasked  by  explicitly  requesting  the  option  the  option is
processed.  As such, the option be the last option in the config‐
uration unless you really want  to  send  something  which  could
identify  you.   will not try and reboot an old lease, it will go
straight into DISCOVER/SOLICIT.  Forces a hardware  address  ran‐
domisation  when  the interface is brought up or when the carrier
is lost.  This is generally used in tandem with the anonymous op‐
tion.  will arping each address in order before attempting  DHCP.
If  an address is found, we will select the replying hardware ad‐
dress as the profile, otherwise the IP address.  Example: Authen‐
ticate DHCP messages.  See the Supported Authentication Protocols
section.  If is then snd_secretid/rcv_secretid so  you  can  send
and receive different tokens.  Define a shared key for use in au‐
thentication.   can  be  "" to for use with the protocol.  is the
date the token expires and should be formatted "yyy‐mm‐dd HH:MM".
You can use the keyword or which means the token  never  expires.
For the token protocol, needs to be 0 and needs to be "".  If has
the error then it means that could not find the correct authenti‐
cation token in your configuration.  Fork to the background imme‐
diately.   This is useful for startup scripts which don’t disable
link messages for carrier status.  Ignores all packets from  Only
accept  packets  from  is  ignored if is set.  Be a BOOTP client.
Basically, this just doesn’t send a DHCP Message Type option  and
will  only  interact with a BOOTP server.  All other DHCP options
still work.  Instructs the DHCP server to broadcast replies  back
to the client.  Normally this is only set for non‐Ethernet inter‐
faces,  such as FireWire and InfiniBand.  In most cases, will set
this automatically.  Sets the group ownership of  so  that  users
other  than root can connect to Echo debug messages to the stderr
and syslog.  Load the management module.  will load the first one
found to work, if any.  Push to the environment for  use  in  For
example,  you can force the hostname hook to always set the host‐
name with Or set which driver should use with If the hostname  is
set, it will be will set to the FQDN if possible as per RFC 4702,
section  3.1.   If the FQDN option is missing, will still try and
set a FQDN from the hostname and domain options for  consistency.
To override this, set A value of means just what the server says,
don’t manipulate it.  This could lead to an inconsistent hostname
on a DHCPv4 and DHCPv6 network where the DHCPv4 hostname is short
and the DHCPv6 has an FQDN.  DHCPv6 has no hostname option.  Send
the If the string is of the format 01:02:03 then it is encoded as
hex.   For  interfaces  whose  hardware  address is longer than 8
bytes, or if the is an empty string then sends a default  of  the
hardware  family  and  the  hardware  address.  Use a DHCP Unique
Identifier.  If a system UUID is available, that will be used  to
create  a DUID‐UUID, otherwise if persistent storage is available
then a DUID‐LLT (link local address + time) is generated,  other‐
wise  DUID‐LL  is  generated (link local address).  The DUID type
can be hinted as an optional parameter if the file does  not  ex‐
ist.   If  not or then will be converted from 00:11:22:33 format.
This, plus the IAID will be used as the The DUID  generated  will
be  held  in  and should not be copied to other hosts.  This file
also takes precedence over the above rules except for  setting  a
value.   Set  the Interface Association Identifier to This option
must be used in an block.  This defaults to the VLANID  (prefixed
with  0xff)  for the interface if set, otherwise the last 4 bytes
of the hardware address assigned to the interface.  Each instance
of this should be unique within the scope of the client and warns
if a conflict is detected.  If there is a conflict, it is only  a
problem  if  the  conflicted  IAIDs are used on the same network.
Enable DHCP on the interface, on by default.   Enable  DHCPv6  on
the  interface,  on by default.  Enable IPv4 on the interface, on
by default.  Enable IPv6 on the interface, on  by  default.   Re‐
quest  the  in  the DHCP DISCOVER message.  There is no guarantee
this is the address the DHCP server will actually give.  If no is
given then the first address currently assigned to the  is  used.
Behaves  like  as  above, but sends a DHCP INFORM instead of DIS‐
COVER/REQUEST.  This does not get a lease as such, just  notifies
the  DHCP  server of the in use.  You should also include the op‐
tional network number in case the address is not already  config‐
ured  on  the  interface.  remains running and pretends it has an
infinite lease.  will not de‐configure the interface when it  ex‐
its.  If fails to contact a DHCP server then it returns a failure
instead of falling back on IPv4LL.  Performs a DHCPv6 Information
Request.   No  address  is  requested or specified, but all other
DHCPv6 options are allowed.  This is normally performed automati‐
cally when an IPv6 Router Advertisement indicates that the client
should perform this operation.  This option is only  needed  when
is  not processing IPv6 RA messages and the need for a DHCPv6 In‐
formation Request exists.  normally de‐configures  the  interface
and configuration when it exits.  Sometimes, this isn’t desirable
if,  for  example,  you have root mounted over NFS or SSH clients
connect to this host and they need to be  notified  of  the  host
shutting down.  You can use this option to stop this from happen‐
ing.  Fall back to using this profile if DHCP fails.  This allows
you  to  configure  a  static  profile instead of using ZeroConf.
Sends the hostname to the DHCP server so it can be registered  in
DNS.   If  is an empty string then the current system hostname is
sent.  If is a FQDN (i.e., contains a .) then it will be  encoded
as  such.  Sends the short hostname to the DHCP server instead of
the FQDN.  This is useful because DHCP servers will not  register
the  FQDN  in their DNS if the domain part does not match theirs.
Also, see the option above to control how the hostname is set  on
the  host.   Request  a DHCPv6 Normal Address for defaults to the
option as described above.  You can request more than  one  ia_na
by  specifying a unique for each one.  Request a DHCPv6 Temporary
Address for You can request more than one ia_ta by  specifying  a
unique  for each one.  Request a DHCPv6 Delegated Prefix for This
option must be used in an block.  Unless a of 0 is assigned  with
the  same  resultant  prefix  length  as the delegation, a reject
route is installed for the Delegated Prefix to  stop  unallocated
addresses  being  resolved upstream.  If no is given then we will
assign a prefix to every other interface with a equivalent to the
interface index assigned by the OS.  Otherwise addresses are only
assigned for each and Each assigned address will have a  default‐
ing  to  1.   If  the is 0 then a SLAAC address is assigned.  You
cannot assign a prefix to the  requesting  interface  unless  the
DHCPv6 server supports the Prefix Exclude Option.  has to be run‐
ning for all the interfaces it is delegating to.  A default of 64
is assumed, unless the maximum does not fit.  In this case is in‐
creased  to the highest multiple of 8 that can accommodate the is
an integer which must be unique inside the and is  added  to  the
prefix  which  must  fit  inside less the length of the delegated
prefix.  You can specify multiple per  space  separated.   IPv6RS
should  be disabled globally when requesting a Prefix Delegation.
In the following example eth0 is the externally facing  interface
to  be configured for both IPv4 and IPv6.  The DHCPv4 server will
provide us with an IPv4 address and a default route.  The  DHCPv6
server  is  going  to  provide us with an IPv6 address, a default
route and a /64 subnet to be delegated to the internal interface.
The eth1 interface will be automatically configured for IPv6  us‐
ing  the first address (::1) from the delegated prefix.  A second
prefix is requested and assigned to two other interfaces.  can be
used with an empty configuration file on eth1, eth2 and eth3,  to
provide  automatic  IPv6  address  configuration for the internal
network.  noipv6rs                 # disable routing solicitation
denyinterfaces eth2      # Don’t touch eth2 at all interface eth0
  ipv6rs                 # enable routing solicitation for eth0
  ia_na 1                # request an IPv6 address
  ia_pd 2 eth1/0         # request a PD and assign it to eth1
  ia_pd 3 eth2/1 eth3/2  # req a PD and assign  it  to  eth2  and
eth3 Only configure IPv4.  Only configure IPv6.  will not ask the
DHCP  server  to update DNS.  just asks the DHCP server to update
the PTR record of the host in DNS, whereas  also  updates  the  A
record.   will  disable  the  FQDN option.  The default is itself
never does any DNS updates.  encodes the FQDN hostname as  speci‐
fied  in  Subsequent  options  are  only parsed for this Generate
SLAAC addresses for each Prefix advertised by an IPv6 Router  Ad‐
vertisement message with the Auto flag set.  On by default.  Dis‐
ables the above option.  By default, when receives an IPv6 Router
Advertisement,  will  only  fork to the background if the RA con‐
tains at least one unexpired RDNSS option and a valid  prefix  or
no DHCPv6 instruction.  Set this option so to make always fork on
a  RA.   Enables IPv6 Router Advertisement solicitation.  This is
on by default, but is documented here in the  case  where  it  is
disabled globally but needs to be enabled for one interface.  Re‐
quest DHCP a lease time of represents an infinite lease time.  By
default  does  not  request  any  lease time and leaves it in the
hands of the DHCP server.  It is not possible to request a DHCPv6
lease time as this is not RFC  compliant.   See  RFC  8415  21.4,
21.6,  21.21  and  21.22.   Override the size of the link receive
buffer from the kernel default.  While  will  recover  from  link
buffer  overflows,  this  may  not be desirable on heavily loaded
systems.  Writes to the specified still writes to The is reopened
when receives the signal.  Metrics are used to prefer  an  inter‐
face over another one, lowest wins.  will supply a default metric
of  1000  +  This will be offset by 2000 for wireless interfaces,
with additional offsets of 1000000 for  IPv4LL  and  2000000  for
roaming  interfaces.   Specifies the URL for a Manufacturer Usage
Description (MUD).  The description is used by  upstream  network
devices to instantiate any desired access lists.  See draft‐ietf‐
opsawg‐mud for more information.  Any pre‐existing IPv4 addresses
will  be  removed  from  the interface when adding a new IPv4 ad‐
dress.  Don’t send any ARP requests.  This also disables  IPv4LL.
Don’t  require  authentication even though we requested it.  Also
allows FORCERENEW and RECONFIGURE  messages  without  authentica‐
tion.   Don’t  delay for an initial randomised time when starting
protocols.  Don’t load management modules.  Don’t start  DHCP  or
listen  to  DHCP  messages.   This  is  only useful when allowing
IPv4LL.  Don’t start DHCPv6 or listen to DHCPv6  messages.   Nor‐
mally  DHCPv6 is started by an IPv6 Router Advertisement instruc‐
tion or configuration.  Don’t install any  default  routes.   In‐
stall  a  default  route  if available (default).  Don’t run this
hook script.  Matches full name, or prefixed with 2  numbers  op‐
tionally  ending  with So to stop from touching your DNS settings
or starting wpa_supplicant you would do:‐ Don’t attempt  to  con‐
figure  an  IPv4  address.  Don’t attempt to obtain an IPv4LL ad‐
dress if we failed to get one via DHCP.  See Don’t solicit or ac‐
cept IPv6 Router Advertisements and DHCPv6.  Don’t solicit or ac‐
cept IPv6 Router Advertisements.   Don’t  receive  link  messages
about  carrier status.  You should only set this for buggy inter‐
face drivers.  Don’t bring the interface up when in manager mode.
Requests the from the server.  It can be a variable to be used in
or the numerical value.  You can specify more separated  by  com‐
mas, spaces or more lines.  Prepend dhcp6_ to to request a DHCPv6
option.  If no DHCPv6 options are configured, then DHCPv4 options
are  mapped to equivalent DHCPv6 options.  Prepend nd_ to to han‐
dle ND options, but this only works for the and options.  To  see
a  list  of  options you can use, call with the argument.  Remove
the option from the message before it’s processed.  Requires  the
to  be present in all messages, otherwise the message is ignored.
To enforce that only responds  to  DHCP  servers  and  not  BOOTP
servers,  you  can  This  isn’t an exact science though because a
BOOTP server can send DHCP‐like options.  Reject a  message  that
contains  the  This is useful when you cannot use to select / de‐
select BOOTP messages.  If detects an address added to a point to
point interface (PPP, TUN, etc) then it will set the listed  DHCP
options  to the destination address of the interface.  Subsequent
options are only parsed for this profile Suppress any dhcpcd out‐
put to the console, except for errors.  Allow seconds before mov‐
ing to the DISCOVER phase if we have an old lease to use.   Allow
seconds  before starting fallback states from the DISCOVER phase.
IPv4LL is started when the first timeout is reached.  The default
is 5 seconds.  A setting of 0 seconds causes to skip  the  reboot
phase  and  go straight into DISCOVER.  This is desirable for mo‐
bile users because if you change from network A to network B  and
they  use the same subnet and the address from network A isn’t in
use on network B, then the DHCP server will remain silent even if
authoritative which means will timeout before moving back to  the
DISCOVER phase.  This has no effect on DHCPv6 other than skipping
the  reboot  phase.  will release the lease prior to stopping the
interface.  Use instead of the  default  Subsequent  options  are
only  parsed  for  this wireless Selects the interface identifier
used for SLAAC generated IPv6 addresses.  If is used, a RFC  7217
address  is generated.  The directive will create a temporary ad‐
dress for the prefix as well.  Configures a  static  If  you  set
then  will  not  attempt  to obtain a lease and will just use the
value for the address with an infinite lease time.   If  you  set
will  continue  auto‐configuration as normal.  Here is an example
which configures two static address, overriding the default  IPv4
broadcast  address,  an  IPv4 router, DNS and disables IPv6 auto‐
configuration.  You could also use the command here if you wished
to obtain more information via DHCPv6.  For IPv4, you should  use
the option instead of setting a static address.  Here is an exam‐
ple for PPP which gives the destination a default route.  It uses
the  special  keyword  to insert the destination address into the
value.  Time out after instead of the default 30.  A setting of 0
causes to wait forever to get a lease.  If is working on a single
interface then will exit when a timeout  occurs,  otherwise  will
fork  into the background.  If using IPv4LL then start the IPv4LL
process after the timeout and then wait a  little  longer  before
really  timing  out.   Tag the DHCPv4 message with the userclass.
You can specify more than one.  Tag the DHCPv4 mesasge  with  the
Microsoft  userclass.   Unlike  the  option, this one can only be
added once.  It should only be used for  Microsoft  DHCP  servers
and the should be set to "MSFT 98" or "MSFT 5.0".  This option is
not RFC compliant.  Add an encapsulated vendor option.  should be
between  1  and  254 inclusive.  To add a raw vendor string, omit
but keep the comma.  Examples.  Set the vendor option 01 with  an
IP  address.   Set the vendor option 02 with a hex code.  Set the
vendor option 03 with an IP address as a string.  Set un‐encapsu‐
lated vendor option to hello world.  Set the DHCP  Vendor  Class.
DHCPv6  has  its  own  option  as  shown  below.   The default is
dhcpcd‐<version>:<os>:<machine>:<platform>.  For example  If  not
set then none is sent.  Some badly configured DHCP servers reject
unknown  vendorclassids.   To work around it, try and impersonate
Windows by using the MSFT vendorclassid.  Add the  DHCPv6  Vendor
Indetifying Vendor Class with the IANA assigned Enterprise Number
with  the This option can be set more than once to add more data,
but the behaviour, as per RFC 3925 is undefined if the Enterprise
Number differs.  Wait for an address to be assigned before  fork‐
ing  to  the  background.  4 means wait for an IPv4 address to be
assigned.  6 means wait for an IPv6 address to be  assigned.   If
no  argument  is  given, will wait for any address protocol to be
assigned.  It is possible to wait for more than one address  pro‐
tocol  and will only fork to the background when all waiting con‐
ditions are satisfied.  Use the last four bytes of  the  hardware
address  as  the DHCP xid instead of a randomly generated number.
DHCP, ND and DHCPv6 allow for the use of custom options, and  RFC
3925  vendor  options for DHCP can also be supplied.  Each option
needs to be started with the or directive.  This  can  optionally
be  followed by both or options.  Both can be specified more than
once and must come before Defines the DHCP option of with a  name
of  exported  to Defines the ND option of with a name of exported
to with a prefix of Defines the DHCPv6 option of with a  name  of
exported  to with a prefix of Defines the Vendor‐Identifying Ven‐
dor Options.  The  is  the  IANA  Enterprise  Number  which  will
uniquely  describe  the  encapsulated options.  is normally names
the Vendor option to be exported.  Defines an  embedded  variable
within  the  defined  option.  The length is determined by the If
the is not the same as defined in the parent option, it  is  pre‐
fixed  with  the parent first with an underscore.  If the has the
name of then it is not processed.  Defines an encapsulated  vari‐
able  within the defined option.  The length is determined by the
If the is not the same as defined in the  parent  option,  it  is
prefixed  with  the  parent first with an underscore.  These key‐
words come before the type itself, to  describe  it  more  fully.
You  can  use  more  than  one, but they must appear in the order
listed below.  Requests the option by default without  having  to
be  specified  in  user configuration.  This option cannot be re‐
quested, regardless of user configuration.  This  option  is  op‐
tional.   Only  makes  sense for embedded options like the client
FQDN option, where the FQDN string itself is optional.   The  op‐
tion  can  appear more than once and will be indexed.  The option
data is split into a space separated array,  each  element  being
the same type.  The type directly affects the length of data con‐
sumed  inside  the  option.   Any remaining data is normally dis‐
carded.  Lengths can be specified for string  and  binhex  types,
but  this is generally with other data embedded afterwards in the
same option.  An IPv4 address, 4  bytes.   An  IPv6  address,  16
bytes.   A  NVT ASCII string of printable characters.  A byte.  A
byte represented as a  string  of  flags,  most  significant  bit
first.   For example, using ABCDEFGH then A would equal 10000000,
B 01000000, C 00100000, etc.  If the bit is not set, the flag  is
not printed.  A flag of 0 is not printed even if the bit position
is set.  This is to allow reservation of the first bits while as‐
signing  the last bits.  A signed 16bit integer, 2 bytes.  An un‐
signed 16bit integer, 2 bytes.  A signed 32bit integer, 4  bytes.
An  unsigned  32bit integer, 4 bytes.  A fixed value (1) to indi‐
cate that the option is present, 0 bytes.  An  RFC  3397  encoded
string.   An RFC 1035 validated string.  Binary data expressed as
hexadecimal.  Contains embedded options (implies encap as  well).
Contains  encapsulated  options  (implies embed as well).  Refer‐
ences an option from the global definition.  Sends a  plain  text
token  the server expects and matches a token sent by the server.
The tokens do not have to be the same.  If unspecified, the token
with a of 0 will be used in sending messages and  validating  re‐
ceived messages.  Delayed Authentication.  will send an authenti‐
cation  option  with no key or MAC.  The server will see this op‐
tion, and select a key for and in it.  will then look for an  un‐
expired token with a matching and This token is used to authenti‐
cate all other messages.  Same as above, but without a realm.  If
none  specified,  is  the default.  If none specified, is the de‐
fault.  If this is changed from what was previously used, or  the
means  of  calculating  or  storing  it  is broken, then the DHCP
server will probably have to have its notion of the client’s  Re‐
play  Detection Value reset.  Read the number in the file and add
one to it.  Create an NTP timestamp from the system  time.   Same
as Please report them to