The Dynamic Host Configuration Protocol (DHCP) is an automatic configuration protocol used on IP networks [RFC 2131]. A major advantage is that it eliminates the need to manually assign each host a static IP address. Hosts can ‘ask’ to join a network and they will be assigned an IP, and provided with additional information such as the subnetmask and gateway IP.
There are two versions of DHCP, one for IPv4 and one for IPv6. While both versions bear the same name and perform much the same purpose, the details of the protocol for IPv4 and IPv6 are sufficiently different that they can be considered separate protocols. In this article we explain the DHCP for IPv4 protocol and its packets.
The DHCP ‘boot’ procol has four steps.
The four most important DHCP packets are: DHCPDISCOVER, DHCPOFFER, DHCPREQUEST and DHCPACK. All DHCP traffic is encapsulated in UDP, and flows between port 68 (client) and port 67 (server). With Wireshark, you can look at DHCP traffic by using “bootp” in the display filter.
We have the following scenario:
- A client with MAC-address 00:11:11:11:11:11 and no IP address. This client wants to join the network.
- A DHCP server with IP 2.2.0.1 and MAC-address 00:22:22:22:22:22.
A typical exchange of DHCP messages for such a scenario looks like this:
| Packet | Source | Destination | |
|---|---|---|---|
| 1 | DHCPDISCOVER sent by client (broadcast) | IP = 0.0.0.0 (MAC=00:11:11:11:11:11) | IP = 255.255.255.255 (MAC=ff:ff:ff:ff:ff:ff) |
| The DHCP discover packet is a request that is broadcast by clients that want to join a network. The packet contains the client MAC address. Additionally, it contains a list of information the client would like to receive. This list may include: subnet mask, DNS server IP, domain name, NETBIOS server IP, etc. | |||
| 2 | DHCPOFFER sent by DHCP server (unicast) | IP = 2.2.0.1 (MAC=00:22:22:22:22:22) | IP = 2.2.0.231 (MAC=00:11:11:11:11:11) |
| When a DHCP server receives an IP lease request from a client, it reserves an IP address for the client and extends an IP lease offer by sending a DHCPOFFER message to the client. The client may receive one or more DHCPOFFER messages from one or more DHCP servers. This message contains the client’s MAC address, the IP address that the server is offering, the subnet mask, the lease duration, and the IP address of the DHCP server making the offer. | |||
| 3 | DHCPREQUEST sent by client (broadcast) | IP = 0.0.0.0 (MAC=00:11:11:11:11:11) | IP = 255.255.255.255 (MAC=ff:ff:ff:ff:ff:ff) |
| A client may choose to accept one of the offered IP address by broadcasting a DHCP request packet. This message contains the IP the client wants to start using, and the IP of the DHCP server that offered the IP. The message is broadcast to the entire network; when other DHCP servers receive this message, they withdraw any offers that they might have made to the client and return the offered address to the pool of available addresses. | |||
| 4 | DHCPACK sent by DHCP server (unicast) | IP = 2.2.0.1 (MAC=00:22:22:22:22:22) | IP = 2.2.0.231 (MAC=00:11:11:11:11:11) |
| When the DHCP server receives the DHCPREQUEST message from the client, the configuration process enters its final phase. The acknowledgement phase involves sending a DHCPACK packet to the client. This packet includes the lease duration and any other configuration information that the client might have requested. At this point, the IP configuration process is completed. The protocol expects the DHCP client to configure its network interface with the negotiated parameters. | |||
After this configuration protocol is completed the client can start using IP address 2.2.0.231. If the DHCPACK message contained information about the default gateway, then the client can also start browsing the Internet without further configuration.
Other DHCP packets are:
- DHCPRELEASE: The client may choose to relinquish its lease on a network address by sending a DHCPRELEASE message to the server. It is not required by the DHCP protocol to send this message, and not every OS does it by default.
- DHCPINFORM: Clients may request local configuration parameters outside of the ‘boot process’ using DHCPINFORM packets. Servers receiving a
DHCPINFORM message construct a DHCPACK message with any local configuration parameters appropriate for the client, without allocating a new address for the client
On windows, the ipconfig tool can be used to view the current IP lease, and force renewal of the lease.
C:\>ipconfig /all Ethernet adapter Local Area Connection: Connection-specific DNS Suffix . : some.domain.com Description . . . . . . . . . . . : Realtek RTL8168B/8111B Family PCI-E Gigabit Ethernet NIC (NDIS 6.20) Physical Address. . . . . . . . . : 00-1A-2D-39-65-3D DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IPv4 Address. . . . . . . . . . . : 132.20.160.168(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.240.0 Lease Obtained. . . . . . . . . . : Tuesday, June 21, 2011 8:07:58 PM Lease Expires . . . . . . . . . . : Tuesday, June 21, 2011 10:07:58 PM Default Gateway . . . . . . . . . : 132.20.160.1 DHCP Server . . . . . . . . . . . : 132.20.1.145 DNS Servers . . . . . . . . . . . : 132.20.2.2 132.20.2.3 Primary WINS Server . . . . . . . : 132.20.4.21 Secondary WINS Server . . . . . . : 132.20.4.22 NetBIOS over Tcpip. . . . . . . . : Enabled
Release the IPv4 address:
C:\>ipconfig /release
Request a new IPv4 address:
C:\>ipconfig /renew
On most Linux distros the ifconfig tool can be used to view the current IP lease.
$ ifconfig
eth0 Link encap:Ethernet HWaddr 00:1A:2D:39:65:3D
inet addr:132.20.160.168 Bcast:132.20.175.255 Mask:255.255.240.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:8675279 errors:0 dropped:0 overruns:0 frame:0
TX packets:189402 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1193997808 (1.1 GB) TX bytes:16051772 (16.0 MB)
Interrupt:10 Base address:0xd000The DHCP client on Linux is called dhclient or dhclient3. To see if you are currently running the client:
$ ps -ef | grep dhclient root 3169 1 0 09:10 ? 00:00:00 dhclient3 -e IF_METRIC=100 -pf /var/run/dhclient.eth0.pid -lf /var/lib/dhcp3/dhclient.eth0.leases eth0
Use the -r switch to release your DHCP lease and terminate the client.
$ sudo dhclient -r
And restart it to negotiate a new lease. The dhclient program will stay in the foreground until it has obtained an IP, then fork into the background.
$ sudo dhclient eth0