Chapter 5. Analyzing Application Layer Protocols

In the previous chapter, we covered the SSL/TLS application layer protocol in detail. In this chapter, we will continue with other application layer protocols (their basic flows and some generic use cases) and learn how to generate these types of traffic:

  • DHCPv6
  • DHCv4
  • DNS
  • HTTP

DHCPv6

The Dynamic Host Configuration Protocol for IPv6 (DHCPv6) is an application layer protocol that provides a DHCPv6 client with IPv6 an address, and other configuration information, that is carried in the DHCPv6 options.

DHCPv6 is both a Stateful Address Autoconfiguration protocol and a Stateless Address Configuration protocol.

The client and server exchange DHCPv6 message over UDP; the client uses a link-local address, DHCPv6 receives message over the link-scoped multicast address. If the DHCPv6 server is not attached to the same link, then a DHCPv6 relay agent on the client's link will relay messages between the DHCPv6 client and DHCPv6 server, as shown in the following screenshot:

DHCPv6

DHCPv6 Wireshark filter

Use the dhcpv6 display filter to show DHCPv6 traffic. For the capturing filter, use UDP port 547.

Multicast addresses

Multicast addresses are used by the DHCPv6 client to send datagrams to a group of DHCPv6 servers:

  • For all DHCP relay agents and servers, the address is FF02::1:2 (link local)
  • For all DHCPv6 servers, the address is FF05::1:3 (site local)

The UDP port information

Servers and relay agents listen for DHCPv6 messages on UDP port 547; clients listen for DHCPv6 messages on UDP port 546. To find the port information, the netstat command can be used:

[root@bash ~]# netstat -an | grep 547
udp        0      0 :::547                      :::*

DHCPv6 message types

DHCPv6 messages are exchanged over UDP port 546 and 547 and the messages are described in the following table:

DHCPv6 message

Description

DHCPv6 Wireshark filter

Equivalent DHCP for IPv4 message

SOLICIT

This message is sent by the client to a group of DHCPv6 servers

dhcpv6.msgtype == 1

DHCPDISCOVER

ADVERTISE

This message is sent by the server, and reveals the server availability for the DHCPv6 service, in response to the SOLICIT message

dhcpv6.msgtype == 2

DHCPOFFER

REQUEST

This message will be sent by the client and contains the IPV6 address or configuration parameter

dhcpv6.msgtype == 3

DHCPREQUEST

CONFIRM

This message will be sent by the client to confirm whether the IPv6 address is still valid for this link or not

dhcpv6.msgtype == 4

DHCPREQUEST

RENEW

This message will be sent by the client to update its lifetime or other configuration parameter

dhcpv6.msgtype == 5

DHCPREQUEST

REBIND

This message will be sent by the client if the RENEW message was not received, and it will update its IPv6 address and other configuration parameters

dhcpv6.msgtype == 6

DHCPREQUEST

REPLY

For every message sent by the client a REPLY message will be received from the server

dhcpv6.msgtype == 7

DHCPACK

RELEASE

This message will be sent by the client to release the IPv6 address and other configuration parameters

dhcpv6.msgtype == 8

DHCPRELEASE

DECLINE

This message will be sent by the client if it found that the IPv6 address is already assigned and in use

dhcpv6.msgtype == 9

DHCPDECLINE

RECONFIGURE

This message will be sent by the server to indicate that configuration parameters are updated or changed; the client will send a RENEW/REPLY or INFORMATION-REQUEST/REPLY to get the updated configuration

dhcpv6.msgtype == 10

N/A

INFORMATION-REQUEST

This message will be sent by the client for the configuration request no IPv6 address assignment

dhcpv6.msgtype == 11

DHCPINFORM

RELAY-FORWARD

This message will be sent by a relay agent to forward a message to a server. RELAY-FORWARD contains a client message encapsulated as the DHCPv6 RELAY message option

dhcpv6.msgtype == 12

N/A

RELAY-REPLY

This message will be sent by a server to send a message to a client through a relay agent. RELAY-REPLY contains a server message encapsulated as the DHCPv6 RELAY message option

dhcpv6.msgtype == 13

N/A

Message exchanges

DHCPv6 message exchanges happen in order to obtain the IPv6 addresses, configuration (NTP server, DNS server), or RENEW/RELEASE/DECLINE of the IPv6 address, and these message exchanges are categorized in two parts:

  • Client-server with a four-message exchange
  • Client-server with a two-message exchange

The four-message exchange

The acronym for a four-message exchange is SARR, and it is used to request the assignment of one or more IPv6 addresses. The message flow is as follows:

  • SOLICIT
  • ADVERTISE
  • REQUEST
  • REPLY

Open the DHCPv6-Flow-SOLICIT.pcap file in Wireshark, and examine the IP assignment flow as shown:

The four-message exchange

The preceding screenshot shows a SARR flow packet being captured. IPv6 is assigned to the DHCPv6 client, and the message exchanges in detail are:

  • SOLICIT: The client (fe80::f816:3eff:fe1d:e848) sends a SOLICIT message to locate the servers. Note the destination is multicast ff02::1:2 not the server (destination) IPv6 address:
    • The client includes its client-identifier option dhcpv6.option.type == 1.
    • The client sends it ORO option (dhcpv6.option.type == 6) to the server that is interested in receiving. In this case, the client has requested the name server information.
    • In this example, the client uses the IA_NA options to request the assignment of non-temporary addresses (dhcpv6.option.type == 3) and uses IA_TA options to request the assignment of temporary addresses.
    • The client IA address option is used to specify IPv6 addresses associated with IA_NA or IA_TA. In this example, it's associated with IA_NA.
  • ADVERTISE: The server (fe80::f816:3eff:fe1d:e848) sends the ADVERTISE (dhcpv6.msgtype == 2) message to the client (fe80::f816:3eff:fe1d:e848). There can be multiple servers that will respond to the client SOLICIT message; the client will choose the DHCPv6 server based on its preference:
    • The server updates the IA_NA (dhcpv6.option.type == 3) value based on its preferences.
    • The server includes its server identifier (dhcpv6.option.type == 2) information. The Server Identifier option is used to carry DUID. The DUID is the DHCP Unique Identifier, the host identifier in IPv6. (In the case of DHCPv4, the host identifier is the MAC address.)
    • The server includes the name server (dhcpv6.option.type == 23) information as requested in the SOLICIT message.
    • The server transaction ID 0x10eafe in this case must match with the client SOLICIT transaction ID.
  • REQUEST: In this message the client chooses one of the servers and sends a REQUEST message to the server asking for confirmed assignment of addresses and other configuration information:
    • The client (fe80::f816:3eff:fe1d:e848) constructs the REQUEST packet and sends it to multicast ff02::1:2
    • The client includes a new transaction ID: 0x3ec03e.(random)
    • The client include server identifier information in the REQUEST packet
    The four-message exchange
  • REPLY: In the case of a valid REQUEST message, the server creates the bindings for that client according to the server's policy and configuration information, records the IAs and other information requested by the client, and sends a REPLY message by setting dhcpv6.msgtype == 7:
    • The server transaction ID 0x3ec03e will be the same as client DHCv6 REQUEST message transaction ID
    • The server will include the server identifier and the client identifier
    • The REPLY message will be part of a two-message exchange and a four-message exchange

The two-message exchange

The two-message exchange will be performed between client and server when IP address assignment is not required or when the DHCPv6 client wants to obtain configuration information such as a list of available DNS servers or NTP servers—for example CONFIRM-REPLY and RELEASE-REPLY. Open the sample DHCPv6-Flow-CONFIRM-RELEASE.pcap file in Wireshark, which shows that a two-message exchange was performed:

  1. DHCPv6 messages CONFIRM-REPLY and RELEASE-REPLY:
    The two-message exchange
  2. DHCPv6 messages INFOMRATION-REQUEST: The client sends the INFORMATION-REQUEST when the client requests configuration settings (but not addresses)—for example, DNS, NTP. As shown in the following screenshot, open the DHCPv6-Information_request.pcap file in Wireshark:
    • Client will set dhcpv6.msgtype == 11:
    The two-message exchange
  3. The rapid commit option is used to obtain the IPv6 address assignment in the two-message exchange, as shown in the following screenshot example, DHCPv6-Rapid-Commit.pcap. Note that rapid commit is not a separate DHCPv6 message and is part of the SOLICIT option:
    The two-message exchange
    • If a client that supports the rapid commit option intends to use the rapid commit capability, it includes a rapid commit option in the SOLICIT messages that it sends.
    • If the client receives a REPLY message with a rapid commit option, it should process the REPLY immediately (without waiting for additional ADVERTISE or REPLY messages) and use the address and configuration information contained therein.
    • If the server doesn't support the rapid commit option, then it will follow with a four-message exchange (SOLICIT, ADVERTISE, REQUEST, and REPLY known as SARR).

DHCPv6 traffic capture

Use dhclient to simulate DHCPv6 traffic over the network. For this, do the following:

  1. Make sure a DHCPv6 server is set up. This example is performed over an ISC Dynamic Host Configuration Server (dhcpd) server.
  2. Run the tcpdump utility to capture IPv6 traffic:
    bash$ tcpdump -i any ip6 -vv -w DHCPv6-FLOW.pcap -s0 &

    Make sure the DHCPv6 server is running in your network.

  3. To capture a DHCPv6 four-message exchange (SARR):
    bash$ dhclient -6 eth0
  4. To capture the DHCPv6 RELEASE message:
    bash$ dhclient -6 -r eth0
  5. To capture the DHCPv6 CONFIRM message:
    bash$ dhclient -6 eth0
  6. To capture the DHCPv6 INFORMATION request:
    bash$ dhclient -S -6 eth0
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.191.29.22