Exploring DHCP
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
The protocol I filtered on is BOOTP. DHCP uses BOOTP as its transport protocol.
Ports 67 & 68 are used for DHCP.
DHCP messages are sent over UDP.
DISCOVER – [Src: 68; Dst: 67] OFFER – [Src: 67; Dst: 68] REQUEST – [Src: 68; Dst: 67] ACK – [Src:
67; Dst: 68]
MAC Address of host: AsustekC_e0:f6:98
Values in the BOOTP?
Transaction ID in the first 4 DHCP messages: 0xdd5ad4bc; Transaction ID of second set:
0x99dcea9a; the transaction ID is used so the server and client associate the messages with each
other.
The source is quad zero (0.0.0.0) and the destination is a broadcast (255.255.255.255)
My DHCP server is 192.168.1.254 (default gateway?)
The DHCP server is offering 192.168.1.73
11. The absence of a relay agent is apparent in the fact that the client and server share the same
subnet.
12. It’s telling the client what the default gateway and subnet mask is for the IP address it’s
supplying.
13. My lease time is 1 day.
14. The DHCP server does not acknowledge the release message. If the release message was lost
and not received by the DHCP server, then the client would continue to have the same IP.
15. Magic cookie helps the server identify what vendor format should be used. I think the magic
cookie will be the same for any DHCP message.