BOOTP/DHCP

DHCP is an extension of the BOOTP mechanism. In other words, DHCP uses BOOTP as its transport protocol. This behavior allows existing BOOTP clients to interoperate with DHCP servers without requiring any change to the clients' initialization software; the following table shows basic comparisons between these two protocols:

BOOTP/DHCP

BOOTP

DHCP (Dynamic Host Configuration Protocol)

Meaning

Bootstrap Protocol

Dynamic Host Configuration Protocol extension of BOOTP

Year

1985

1993

UDP Server Port

67

UDP Client port

68

Services
  • IPv4 address assignment
  • Obtaining IPv4 configuration parameter
  • Limited number of client configuration parameters called vendor extensions
  • IP address assignment
  • Leases
  • Support legacy BOOTP functionality
  • DHCP supports a larger and extensible set of client configuration parameters called options

RFC

RFC951

RFC 2131

Existence

Superseded by the Dynamic Host Configuration Protocol (DHCP)

ACTIVE; RFCs keep coming to add more features and support different technical requirements

BOOTP/DHCP Wireshark filter

Use the bootp filter to display BOOTP/DHCP traffic and use UDP port 67 to capture the BOOT/DHCP traffic only.

Address assignment

DISCOVER, OFFER, REQUEST, ACK protocol exchanges happen between clients and servers during network address assignment, as shown in the following screenshot. As a mnemonic, refer to this as DORA.

The address assignment can also be done using the Rapid Commit option for DHCPv4. Modeled on DHCPv6, it uses two-message exchanges to quickly configure the DHCPv4 client.

Address assignment

To demonstrate four-message exchange open the DHCPv4.pcap file in the Wireshark, as shown in the following screenshot:

Address assignment

The preceding figure shows a message exchange happening between the DHCPv4 client and DHCPv4 server. This is summarized as follows:

  • DISCOVER (bootp.option.dhcp == 1):
    • Expand Bootstrap protocol to view BOOTP details
    • The client broadcasts (255.255.255.255), a DHCPDISCOVER message, on its local physical subnet and may include the option: (55 that is bootp.option.type) parameter request list; during this time the "yiaddr" field will be (bootp.ip.your == 0.0.0.0)
  • OFFER (bootp.option.dhcp == 2):
    • Expand Bootstrap protocol to view BOOTP details
    • The DHCP server may respond with a DHCPOFFER message that includes an available network address in the "yiaddr" (bootp.ip.your == 10.0.0.106) field
    • The DHCP server will send its option 54: DHCP server identifier and may include the other configuration parameter as requested in option 55 the DICOVER phase
  • DHCPREQUEST (bootp.option.dhcp == 3):
    • Expand Bootstrap protocol to view BOOTP details
    • The client broadcasts (255.255.255.255) a DHCPREQUEST message that must include the option 54 DHCP server identifier to indicate which server it has selected, and may include other options specifying the desired configuration values
    • The DHCP server selected in the DHCPREQUEST message commits the binding for the client to the db storage and responds with an ACK
  • ACK (bootp.option.dhcp == 5):
    • Expand Bootstrap protocol to view BOOTP details
    • The server will send the ACK to the client with the configuration parameter; during this time the IPv4 address will be "yiaddr" (bootp.ip.your == 10.0.0.106)
    • The client will verify the obtained configuration and check the IPv4 address again using the ARP protocol; if the address is in use by other dhcp clients, the client will send a DECLINE message to the server and restart the configuration process

Capture DHCPv4 traffic

The commands to capture DHCPv4 traffic are as follows:

  • On a Windows machine:
    1. Start a Wireshark capture.
    2. Open the Command Prompt.
    3. Type ipconfig /renew and press Enter.
    4. Type ipconfig /release and press Enter.
    5. Stop the Wireshark capture.
  • On a Linux machine:
    1. Start a Wireshark capture.
    2. Open the Command Prompt.
    3. Bring down the network interface:
      bash# ifdown eth0:0
    4. Bring up the network interface:
      bash$ ifup eth0:0
    5. Stop the Wireshark capture.
  • Using dhclient:
    1. Start a Wireshark capture.
    2. Open the Command Prompt.
    3. To capture a DORA packet use:
      bash$dhclient -4 eth0
    4. Stop the capture.
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.129.26.22