Okay so let's have a look at Wireshark, now before getting into the nitty-gritty.
I want to show you a really nice option in Wireshark. Notice here we have messages, discover, offer, request
and acknowledgement. In Wireshark
you can go to the statistics menu and click flow graph and you can see messages being sent on the network.
I'm gonna limit this to the filter which at the moment is DHCP
And notice what you can see in the output here.
Make this a bit smaller so I can zoom in.
Notice we've got DHCP discover with this transaction I.D. ending in C3.
Here's an offer.
Here's a request and here's an acknowledgement.
This shows graphically the process of how the client,
notice there is no IP address here sends a broadcast message 255.255.255.255 trying to discover
DHCP servers on the network.
So it's saying, who's out there?
I need an IP address the DHCP server offers an IP address to the client.
There may be multiple DHCP serves on the network so the DHCP service that receive these discover messages
will offer IP addresses to the client.
The client will then request one of those IP addresses.
In this example is only one DHB server so it's only going to request the IP address from that DHB server
but if there were multiple DHCP servers in the network it would request an IP address from one of them.
Typically the first one to offer an IP address and then the DHCP server will acknowledge that request.
This is a great option in Wireshark you can graphically see discover, offer, request, and acknowledgement.
Again discover try and discover DHCP servers on the network.
DHCP server will offer an IP address to the client.
The client will then accept that offer and request the IP address from that DHCP server and the DHCP server
will acknowledge that request. Now notice in the Wireshark capture
I've got a DHCP discover, DHCP offer, DHCP request, and DHCP acknowledgment, notice the IP address on DHCP
Discover there is no IP address.
It's sending a message to a broadcast address, so the PC is trying to discover a DHCP server on the Internet.
Notice the MAC address ends in 80b0 going back to my PC notice MAC address ends in 80b0.
So this message is being sent from that Windows PC we can also see that by looking at the client identifier.
Notice MAC address their message type is DHCP discover the PC is trying to discover a DHCP server
and as mentioned notice, it's requesting to use this IP address.
The reason for that is because once again the PC used that IP address previously and is trying to get
the same IP address.
If a new device boots up it won't do that and I'll show you that in a moment
but because this MSEDGEWIN10
PC previously was allocated this IP address it's simply requesting the same IP address again.
Notice you can see under hostname the name of this window's PC once again
there it is on the windows host.
So in windows and in Wireshark, so first step is Discover, PC is trying to discover the DHCP server.
Now, this IP address once again 10.1.1.254 is the DHCP server.
In our example, this is the router, router is configured with this IP address. So the router replies back
to a broadcast address because the client doesn't have an IP address yet. It can't send a message to an
IP address because the client doesn't have an IP address. So broadcasts saying your IP address is this
so your client IP address is this, your client MAC address remember ending an 80b0.
That is the MAC address of this windows
PC so that MAC address will get this IP address.
Option 53,
this is an offer from this DHCP server I'll just jump back for a moment.
Notice the protocol used here is UDP from source port 68 to destination port 67.
but here we're using DHCP which uses UDP.
In this example, source port is 67 going to destination port 68
and again the server with this identifier is allocating an IP address to the client with a lease time
of one day.
It needs to renew after 12 days
as I said previously typically after half the lease period clients will be told to renew. Notice subnet
mask default gateway
Option 3 here default gateway or router DNS server option 6 and option 15 is domain name.
So that's the offer from the DHCP server to the client.
The client then requests that IP address the reason why is we could have multiple servers offering IP
addresses to the client and it needs to request one of them.
So you could have two DHCP servers offering IP addresses to the client it needs to choose one typically
chooses the one that replied first.
So going up notice its UDP source port 68 going to 67 MAC address is the client.
It's a request.
So we're requesting that this MAC address use this IP address the IP address that was offered by the
server. So back again notice the server offered that IP address to the client and that's the IP address
the client is requesting to use. So requested IP address is this from this DHCP server
this is my hostname. Because this is Windows that asks for NetBIOS old protocol ask for other information
such as private classless static route et. cetera
and then lastly the server acknowledges that request.
So UDP source port 67 to port 68
the service saying I acknowledge this as your IP address
this is your MAC address.
It's an acknowledgment and then similar kind of information is displayed once again.
So notice we have four messages here.
Discover, offer, request, and acknowledgement.
Okay
So that's a Wireshark let's have a look on the router.
So again this is the MAC address of our client.
This is the IP address that it got from the DHCP server, on the router now show IP DHCP bindings.
Notice this MAC address was allocated this IP address automatically show IP DHCP server statistics.
We can see as an example that we have one address pool.
There's been five discovered messages were received.
There's been 12 DHCP requests and 3 offers, and 5 acknowledgments a bunch of stuff has been
going on in the background here.
Most important command here is typically binding so that you can see which client received which IP
address.
Okay, so I have got a Linux host here.
I'll start this Linux host up go back into Wireshark and what you'll see is we've got a bunch of DHCP
messages now.
What I can do very nicely in Wireshark is do a filter so that I only see one host.
Notice this MAC address here ends in C 955 that is the MAC address of the Linux client
we can see as an example that this Linux client has obtained this IP address.
IF config, because this is Linux, shows me IP address shows me the MAC address ending in C955.
In Wireshark I could actually add this as a filter.
So add this as and select it.
So this changes the Wireshark filter to only show me that PC rather than the windows
PC. So I'm only seeing the messages from that Linux client.
So notice here's a Discover message sent out a broadcast.
This is the offer from the DHCP server.
Here's a request and here's an acknowledgement.
So if we look at the Discover message notice it doesn't have an IP address.
It's sending out a broadcast with its MAC address trying to discover DHCP server it wants various parameters
including NTP. The DHCP server replies back with an offer offering this IP address 10.1.1.1 to this client
DHCP servers this again lease time, renewal time.
Other information is displayed so on the client I can see that it got given this IP address by the DHCP
server it requested that IP address so request of this IP address and the DHCP server acknowledged that
3IP address.
Okay so that was quite a detailed video.
I hope after this video you really understand how DHB works.