Skip to content

Lab04DHCP

Jump to bottom
echadbourne edited this page Sep 27, 2023 · 1 revision

Notes from Beginning

From now on we are remote-ing into the dhcp server, I used ssh in Windows Powershell. There is also the option to use PuTTY, which I have also installed as an alternative.

Installing DHCP Service

After remote connecting to the DHCP01 box, I started by establishing where and who I am with the pwd, hostname, and whoami commands. Then, I began the installation of the DHCP service with this command:

sudo yum install dhcp

After the installation was complete, I needed to get into the configuration file, like so: vi /etc/dhcp/dhcpd.conf. From here I needed to figure out how to edit the document using Vim. I used a to append text after the cursor, which I moved to the end of the document using the arrow keys. You can also use i to insert text. Then I used ZZ to save and exit the document. At this point it was time to move in to starting the services.

Starting DHCP Services

"systemctl" is what you use to start, stop, and check the status of services. We use it for dhcp below.

Start dhcp with the following command:

systemctl start dhcpd

  • The "d" stands for Daemon which in Linux means service

Check it's status: systemctl status dhcpd

!!! If you do not enable a service to start on boot it will fail when you reboot the device. To enable dhcp to start on boot use the command systemctl enable dhcp

Configuring the Firewall for DHCP requests

firewall-cmd --list-all - Shows the default firewall that allows dhcpv6-client and ssh.

Adding the dhcp service to the firewall:

  • firewall-cmd --add-service=dhcp --permanent

(The --permanent tag makes it so this new thing "sticks" after a reboot)

Reload by using the --reload tag: firewall-cmd --reload

We have now added "dhcp" to the list of services allowed

Configuring WKS01 for DHCP

To configure wks01 to use DHCP you go into the IPv4 properties and change both of the selections to "Obtain Automatically," this will send a request to the DHCP server for an automatically assigned IP address and DNS server.

wks01 dhcp-related commands:

  • You can see the IP configuration with ipconfig /all
  • You can drop the lease on dhcp acquired IP information with ipconfig /release
  • You can get/renew dhcp ip information with ipconfig /renew

Other DHCP Stuff

Lease Time Commands

The numbers for these commands are in seconds (ie a default lease time of 60 is one minute)

  • default-lease-time [time] - sets the default lease time
  • max-lease-time [time] - sets the maximum lease time

Edit/add this in the config file under /etc/dhcp/dhcpd.conf

Exploring More

I didn't really know what to do for this so I decided to just start a capture and release the dhcp lease and see what the packet in wireshark looked like.

  • I found a dedicated "DHCP release" packet
  • Most of the rest of the information was either the same or same type as what I found when looking at the original renewal of the lease previously, but I did find it interesting that under the DHCP release header I found that all of the ip addresses had been changed to 0.0.0.0. This is not unusual, as it is something I would have expected, but I found it interesting nevertheless. The only addresses in there are the device MAC address and the dhcp server IP address.

Next I just wanted to release and renew the lease and see what other traffic happens on the network when I do that. So, I started another capture and began my experiment.

  • I start by releasing the lease like normal, then I renewed it again
  • Looking at all of the network traffic, I see a ping from 10.0.5.3 (the ip of the dhcp server) to 10.0.5.100 right after the dhcp discover packet. Then after that the offer, request, and acknowledge happen. This is the only ping I see
  • What is especially interesting to me is that there is no response to the ping. Considering that this is before wks01 got the 10.0.5.100 IP address assigned to it, I think this is the dhcp server checking to see if there is already a device with that ip, and when they get no response, the ip is finally assigned to wks01

Finally, after my last discovery I wanted to take a look at the "discover" packet a little more closely to see if it requested a specific address.

  • I looked through the DHCP header of the discover packet a little more closely, and found a section that said "Requested IP Address: 10.0.5.100"
  • Next I wanted to see if there was a way I could force it to not request the same address again. I did not find any commands other than /release and /renew, so it does not seem like this is possible without manually assigning a different address. I think this is because asking for the same address makes it easier on other devices because it means they will not have to adjust their cache of ip information to account for the change. It minimizes ARP requests and thus minimizes traffic on the network.

Clone this wiki locally