‫Dynamic host configuration protocol DHP now it's a protocol used to provide automatic and central management
‫for the distribution of IP addresses within a network.
‫It's also used to configure the proper subnet mask, default gateway and DNS server information on the
‫device.
‫In most homes and small businesses, the router acts as a DHCP server in large networks, a single computer
‫might act as a DHP server.
‫In short, the process goes like this.
‫The device the client requests an IP address from a router, the host.
‫After which the host assigns an available IP address to allow the client to communicate on the network.
‫So let's look at some of the advantages of using the HP.
‫A computer or any other device that connects to a network local or internet must be properly configured
‫to communicate on that network.
‫Makes sense since DHP allows that configuration to happen automatically.
‫It's used in almost every device it connects to a network, including computers, switches, smartphones,
‫gaming consoles, you name it.
‫And because of this dynamic IP address assignment, there's less of a chance that two devices will have
‫the same IP address, which is very easy to run into when using manually assigned static IP addresses.
‫Using DHP also makes a network much easier to manage from an administrative point of view.
‫Every device on the network can get an IP address with nothing more than their default network settings,
‫which is set up to obtain an address automatically.
‫So that's easy gives them nothing to call the helpdesk about.
‫The only other alternative is to manually assign addresses to each and every device on the network.
‫You're not getting paid enough to do that.
‫So because these devices can get an IP address automatically, they can move freely from one network
‫to another, given that they're all set up with DHP and receive an IP address automatically, which
‫is super helpful with mobile devices.
‫Now, as a cyber security expert, you should know one more thing about the DHP mechanism.
‫The first device, which replies to a DHC Discovery request decides the configuration of the client.
‫There is not any mechanism to authenticate the DHP server.
‫Similarly, a DHP server tries to reply to all the DHP requests.
‫And again, there is no authentication mechanism for the client who request an IP.
‫You get it.
‫I think you do.
‫What if a hacker replies before the real deal?
‫Or what if a client sends a lot of DHCP discovery requests by changing the Mac address each time?
‫So let's have a look to see how a DHP mechanism works in detail.
‫Once a device is turned on and connected to a network that has a DHCP server, it will send a request
‫to the server called a DHP Discover request.
‫After the Discover packet reaches the DHP server, the server attempts to hold on to an IP address that
‫the device can use and then offers a client the address with a DHP offer packet.
‫Once the offer has been made for the chosen IP address, the device responds to the DHB server with
‫a DHB request packet to accept it.
‫After which the server sends an act packet that's used to confirm that the device has that specific
‫IP address and to define the amount of time that the device can use the address before getting a new
‫one.
‫If the server decides a device cannot have the IP address, it will send a knack.
‫Let's see the DHCP server mechanism and Wireshark.
‫So Wireshark is already embedded into colli and it's ready to use.
‫In addition, I'd also like to show you how to download and install it in a Windows system.
‫So right now, I'm in a Windows eight system.
‫Open the internet browser and search for Wireshark for Windows.
‫Using those is the keywords.
‫First link is the download page of Wireshark Gorgie, so it's click it.
‫My windows is 64 bit, so I'll download the 64 bit, which is the latest stable version, click it and
‫say the installer.
‫Now it takes less than a minute unless your connection is a mess.
‫You might want to look into that.
‫Just kidding.
‫Click to run it.
‫The setup wizard opens.
‫OK, so simply, it's a next next, next finish installation.
‫No need to change anything.
‫Wait until the installation finishes.
‫OK, so check this to run Wireshark now and click finish.
‫And welcome to the wire and Windows interface.
‫So now I will show you the DHP mechanism and Wireshark.
‫So let's run Wireshark, and you can see that it's listing the packets received by eth0.
‫So to demonstrate the DHC mechanism.
‫We need to ask for an IP address over the DHCP server.
‫From the bottom right corner, right click to the network icon and select Open Network and sharing center,
‫click either net zero and then properties, you know, I've scroll down a little bit and double click
‫IP version for.
‫And as you see here, the IP address is manually set for my Windows eight.
‫So to start a DHCP request, I'll choose obtain an IP address and DNS server address automatically.
‫Those are my options.
‫Now, before I click, OK, I'll go to Wireshark and restart, capturing by clicking the green button
‫on the toolbar.
‫So now Wireshark windows will be cleaned continue without saving to now go to the network status window
‫and click OK, and we can close all the networking windows.
‫So Wireshark captured the packets.
‫Well, it's still catching.
‫But let's go to the top of the list to find the DHP packets.
‫So here the DHP Discover packet is right here at the top of the list when we look at the ports in the
‫UDP header.
‫We see that the Port 68 is used to send the HP Discover packets.
‫So let's go back to the filter box and type UDP port equals equals 68.
‫And now we have the DHP packets only.
‫So the first packet is the HP Discover, and as I mentioned before, its broadcast source IP is all
‫zeros because we don't have an IP address at the moment, destination IP is our ones.
‫255.255.255.0, five, five, because it's a broadcast packet.
‫And right here is Bootstrap Protocol, which is an application layer protocol used by DHP mechanisms.
‫A second packet is a DHP offer packet sent by the DHP server one seven two point one six nine nine two
‫five four to the Windows system destination IP is one seven two two eight one six nine nine nine two
‫three three, which is offered to the DHP server.
‫So in here, the destination Mac address is important.
‫That's what's going to be targeted according to the Mac address, because you see the destination Mac
‫address of the DHC offer packet is the same as a source Mac address of the DHCP Discover packet.
‫Now, the third packet is the DHP request sent by the window system.
‫It's still a broadcast packet and a source IP is still all zeros.
‫The message is request, and the requested IP address is an option 50, so if you expand it, you see
‫the requested IP address.
‫And it's the same as the offered IP address.
‫One seven two two one six nine nine two two three.
‫The last packet is the HP Ach sent by the DHP server to the Windows system.
‫This packet completes the DHP mechanism successfully.
‫So from now on, the IP address of our Windows system is one seven two eight one six nine nine eight
‫two two three.