DHCP Basics
Minasi NF pg. 262 - 264, 435 - 471
Svidergol Mastering Windows Server 2016 pg. 202 - 210
Morimoto Windows Server 2016 Unleashed pg. 323 - 331, 337 - 350
Thomas Server 2016 Inside Out pg. 175 - 183
MAC vs IP Address Assignment
Any host in an Ethernet/IP based network must have two unique addresses in order to communicate
with other hosts in the network - a MAC address and an IP address.
The assignment of a MAC address to a host is done at the time of manufacture as every NIC has a
MAC address burned into its PROM at the factory where the NIC is manufactured.
The assignment of an IP address however, cannot be done at the time of manufacture as its value
depends on the network to which the host will eventually belong, and this cannot be predicted at the
time of manufacture. Furthermore, the host may be moved from one network to another with each
move requiring a change in IP address.
Manual IP Assignment
In the early days of networking, prior to the use of RARP, BOOTP or DHCP, IP addresses were
assigned manually. An administrator had to visit each host and manually configure an IP address. This
was a tedious process and prone to error. An administrator had to maintain carefully written records
to ensure that no two hosts received the same IP address, and an administrator also had to take care
not to mistype and mistakenly assign the wrong IP address.
RARP - Reverse Address Resolution Protocol (1984) - Non Routable
SUMMARY:
•
Manual Only
•
Client broadcasts a RARP request
•
RARP server consults RARP table containing list of IP addresses manually preassigned to manually pre-entered
MAC addresses
•
Restricted to local network segment - one RARP server per network segment
The introduction of RARP in 1984 (RFC 903) helped to reduce the amount of work involved in
assigning IP addresses and also helped to reduce the risk of erroneously assigning duplicate IP
addresses.
A RARP server contains a RARP table mapping IP addresses to registered MAC addresses. Before a
new host is added to a network, its MAC address is manually entered into the table along with a
unique IP address. When a host (RARP client) boots up, it broadcasts a RARP Request looking for a
RARP server. A RARP server receiving the RARP Request examines the source MAC address contained
in the request and responds with a reply containing the IP address which had been pre-assigned to the
host.
The use of a single table centralizes the management of IP addresses and eliminates the need for an
administrator to visit each individual host on the network and manually assign an IP address. This
helps to reduce the risk of assigning either duplicate IP addresses or the wrong IP addresses to hosts
in the network.
Since RARP request packets are broadcast packets, they will not pass through a router and are
therefore restricted to the local network segment. Because of this limitation, each network segment
must have its own RARP server.
Notes 1 - DHCP Basics
1/8
Gnall
DHCP Basics
BOOTP - Bootstrap Protocol - Routable via Relay Agent (1985) = RARP + Relay Agent
SUMMARY:
•
Manual Only
•
Client broadcasts a BOOTP request
•
BOOTP server consults BOOTP table containing list of IP addresses manually preassigned to manually
pre-entered MAC addresses
•
RFC 1542 BOOTP Relay Agent service allows one BOOTP server to serve multiple network segments
- If BOOTP server address is unknown, 1542 router rebroadcasts BOOTP request
- If BOOTP server adderss is known, 1542 router sends unicast BOOTP request directly to BOOTP server
RARP broadcast request packets are confined to their own broadcast domain. Because of this, each
network segment required its own RARP server. Since maintaining individual RARP servers for every
network segment was both costly and inefficient, a better way of centrally assigning IP addresses was
needed.
A year after RARP was invented, BOOTP was introduced (1985, RFC 951) to deal with the fact that
RARP is a non-routable protocol (packets do not cross a router from one network to another).
A BOOTP client still relies on the use of non-routable broadcast packets, but can also make use of a
BOOTP Relay Agent service to pass BOOTP broadcast packets through a router.
The BOOTP Relay Agent service is usually installed on a router, and such a router is referred to as a
RFC 1542 compliant router. (If a router does not support RFC 1542, then a separate BOOTP Relay
Agent server can be added to the network and instructed to forward unicast BOOTP Request packets
through the router.)
When a router running the BOOTP Relay Agent service receives a BOOTP Request packet, one of two
things will happen:
•
If the router IS configured with the IP address of a BOOTP server, then the router will use a
point-to-point unicast packet to relay the request directly to the BOOTP server. The IP address
of the BOOTP server is substituted for the broadcast destination IP address in the original BOOTP
Request packet.
•
If the router is NOT configured with the IP address of a BOOTP server, it will rebroadcast
the request to all of the other networks to which it is connected. If there is no BOOTP server in
any of the networks to which the router is directly connected, then there must be another RFC
1542 compliant router or a separate BOOTP Relay Agent server present in one of the networks,
either of which can forward the packet again.
Each time the BOOTP Request packet is relayed through a router, the Hop-Count Threshold
value is increased by one up to a maximum of 16. The Hop-Count Threshold is the maximum
number of relay agent hops allowed and has a default value of 4. Limiting the number of
router hops helps to reduce the amount of broadcast traffic flooding the network. Note: the HopCount Threshold value is different from the TTL value (Time-To-Live).
A BOOTP Relay Agent will wait a number of seconds as specified by the Boot Threshold before
relaying a BOOTP Request packet. This gives local BOOTP servers time to respond before the BOOTP
request is forwarded to a backup BOOTP server located in another network. The default Boot
Threshold value is 4 seconds.
Any Windows Server computer with RRAS configured can act as a relay agent, whether or not the
server is also functioning as a router.
(DHCP also makes use of relay agents. When configuring a DHPC Relay Agent, one is really
configuring a BOOTP Relay Agent.)
Even though BOOTP improves over RARP by supporting the use of a relay agent, it still
suffers from the need to manually maintain a table mapping manually pre-assigned IP
addresses to a list of manually collected MAC addresses.
DHCP (covered in the next section) solves this problem by providing the ability to automatically assign
IP addresses to hosts on a network without the use of a manually created table.
Notes 1 - DHCP Basics
2/8
Gnall
DHCP Basics
DHCP - Dynamic Host Configuration Protocol (RFC 1531 - Oct, 1993) = BOOTP + Automatic/Dynamic
SUMMARY:
•
Manual, Automatic, Dynamic
•
Client broadcasts a DHCP Discover Packet
•
DHCP either assigns IP addresses from a MAC reservation or assigns temporarily/permanently from a
predefined list of IP addresses (scope)
•
RFC 1542 BOOTP Relay Agent service allows one DHCP server to serve multiple network segments
- If DHCP server address is unknown, 1542 router rebroadcasts DHCP Discover
- If DHCP server adderss is known, 1542 router sends unicast DHCP Discover directly to DHCP server
The use of BOOTP continued into the early 1990s, but as the size of networks grew, it became ever
more burdensome to manually maintain a table mapping IP addresses to MAC addresses.
DHCP improves on BOOTP in that while still allowing the manual assignment of IP addresses to specific
MAC addresses (MAC reservation), it also enabled the dynamic/automatic IP configuration of a client
by allowing the DHCP server to automatically select an IP address from a pre-configured range of IP
addresses.
RFC 2131 describes three mechanisms by which a DHCP server can assign an IP address to a DHCP client:
•
•
•
Manual
- Same process as RARP and BOOTP. A table mapping specific IP addresses to specific
MAC addresses is manually maintained on the server (MAC Reservation).
Automatic - IP address is assigned permanently from a pre-specified range of IP addresses.
Dynamic - IP address is assigned temporarily from a pre-specified range of IP addresses.
Some servers must have a specific permanent IP address which never changes. There are two
methods with which to assign such an address:
•
•
Static
Manual
- Physically visiting the host and manually assigning a static IP address.
- DHCP MAC Reservation.
When deciding which method to use, Minasi recommends:
Static
Manual - DHCP MAC Reservation
Default Gateway
DHCP Server
WINS Server
DNS Server
Domain Controller
Web Server
Mail Server
In addition to assigning an IP address to a DHCP client, DHCP improves upon BOOTP by optionally
providing a DHCP client with additional information such as:
•
IP addresss of a default gateway (router)
•
IP addresses of WINS / DNS servers
DHCP Features:
•
IP address assignments are usually not permanent, but instead have a specific lease time.
•
IP address assignment range can be specified as a scope of addresses (scope is Microsoft's terminology).
•
IP addresses can be excluded from the scope (e.g. IP addresses which are statically assigned).
•
IP addresses can be reserved for specific MAC addresses (which mimics the functionality of BOOTP).
Both the BOOTP and DHCP servers use the same port number - 67. So it is impossible to run both
services on the same server. BOOTP and DHCP clients also use the same port number - 68.
•
•
BOOTP/DHCP server port number = 67
BOOTP/DHCP client port number = 68
Wireshark: Since DHCP is based on BOOTP, both "bootp" and "dhcp" can be used as the filter protocol.
Notes 1 - DHCP Basics
3/8
Gnall
DHCP Basics
DHCP Sequence: Four-Way Handshake
DHCP Initial Process
DHCP
A
X
DHCP Discover Packet
Client -> Server(s)
S
Y
DHCP
B
X
DHCP
A
S
Y
DHCP
B
X
DHCP
A
S
Y
DHCP
B
X
DHCP
A
Client sends out a broadcast packet searching for
a DHCP server.
DHCP Offer Packet
Server(s) -> Client
All DHCP servers respond with the offer of a full
IP configuration. (The Offer packet may or may
not be a broadcast packet depending on the
DHCP service implementation.)
DHCP Request Packet
Client -> Server(s)
Client requests a specific IP configuration from
the DHCP server with the best offer (usually the
first offer the client received).
DHCP Acknowledgement Packet (ACK)
Server -> Client
S
DHCP
B
Y
DHCP server whose offer was accepted responds
again with a full IP configuration.
MAC - Source
MAC - Destination
IP - Source
IP - Destination
Discover
Client → Server(s)
Client MAC
FF:FF:FF:FF:FF:FF
0.0.0.0
255.255.255.255
Offer
Server(s) → Client
Server MAC
Client MAC (VMWS)
OR
FF:FF:FF:FF:FF:FF ('16)
Server IP
Offered IP Addr (VMWS)
OR
255.255.255.255 ('16)
Request
Client → Server(s)
Client MAC
FF:FF:FF:FF:FF:FF
0.0.0.0
255.255.255.255
Acknowledgement
Server → Client
Server MAC
Client MAC (VMWS)
OR
FF:FF:FF:FF:FF:FF ('16)
Server IP
Offered IP Addr (VMWS)
OR
255.255.255.255 ('16)
Notes 1 - DHCP Basics
4/8
Gnall
DHCP Basics
DHCP Renewal Process
DHCP Request Packet
DHCP
A
X
Client -> Server
Client requests it’s current IP address from the
same DHCP server.
S
Y
DHCP
B
X
DHCP
A
NOTE: Unlike with the four-way handshake, this
request packet is unicast, not broadcast.
DHCP Acknowledgement Packet (ACK)
Server -> Client
S
DHCP server responds with a full IP configuration
containing the same IP address or a new IP
address.
DHCP
B
Y
VMWS
MAC - Source
MAC - Destination
IP - Source
IP - Destination
Request
Client → Server(s)
Client MAC
Server MAC *
OR
FF:FF:FF:FF:FF:FF !
Client IP *
OR
0.0.0.0 !
Server IP *
OR
255.255.255.255 !
Acknowledgement
Server → Client
Server MAC
Client MAC
Server IP
Client IP
Server 2016
MAC - Source
MAC - Destination
IP - Source
IP - Destination
Request
Client → Server(s)
Client MAC
Server MAC *
OR
FF:FF:FF:FF:FF:FF !
Client IP *
OR
0.0.0.0 !
Server IP *
OR
255.255.255.255 !
Acknowledgement
Server → Client
Server MAC
Client MAC *
OR
FF:FF:FF:FF:FF:FF !
Server IP
Client IP *
OR
255.255.255.255 !
* renew
! reboot
http://www.tcpipguide.com/free/t_DHCPLeaseLifeCycleOverviewAllocationReallocationRe.htm
(Microsoft) DHCP clients will issue a Request packet when rebooted and when 50% of the lease time
(renewal time) is up. If the original DHCP server can't be found at the 50% mark, then the client will
try repeatedly until the lease is at 87.5% (rebinding time). At that point, the client will issue a new
DHCP discover packet, and restart the whole DHCP Initial Process all over again.
APIPA - Automatic Private IP Addressing
Minasi NF pg. 263 - 264, 270, 306
Kozierok pg. 1058 - 1061
APIPA will allow hosts on the same network segment to still communicate with each other in the
absence of a DHCP server. If a DHCP server cannot be found, a DHCP client will assign itself a random
IP address from the 169.254.0.0/16 address space. The DHCP client will use ARP to test if any other
host on the local network has assigned itself the same IP address.
Notes 1 - DHCP Basics
5/8
Gnall
DHCP Server Configuration
https://technet.microsoft.com/en-us/library/cc958940.aspx
Message Type
Description
DHCP Discover
The first time a DHCP client computer attempts to log on to the network, it
requests IP address information from a DHCP server by broadcasting a DHCP
Discover packet. The source IP address in the packet is 0.0.0.0 because the client
does not yet have an IP address. The message is either 342 or 576 bytes long—
older versions of Windows use a longer message frame.
DHCP Offer
Each DHCP server that receives the client DHCP Discover packet responds with a
DHCP Offer packet containing an unleased IP address and additional TCP/IP
configuration information, such as the subnet mask and default gateway. More
than one DHCP server can respond with a DHCP Offer packet. The client will
accept the first DHCP Offer packet it receives. The message is 342 bytes long.
DHCP Request
When a DHCP client receives a DHCP Offer packet, it responds by broadcasting a
DHCP Request packet that contains the offered IP address, and shows
acceptance of the offered IP address. The message is either 342 or 576 bytes
long, depending on the length of the corresponding DHCP Discover message.
DHCP Acknowledge
(DHCP Ack)
The selected DHCP server acknowledges the client DHCP Request for the IP
address by sending a DHCP Ack packet. At this time the server also forwards any
optional configuration parameters. Upon receipt of the DHCP Ack, the client can
participate on the TCP/IP network and complete its system startup. The message
is 342 bytes long.
DHCP Nak
If the IP address requested by the client cannot be used because it is no longer
valid or is now used by another computer, the DHCP server responds with a
DHCP Nak packet, and the client must begin the lease process again. Whenever a
DHCP server receives a request for an IP address that is invalid according to the
scopes that it is configured with, it sends a DHCP Nak message to the client.
DHCP Decline
If the DHCP client determines the offered configuration parameters are invalid, it
sends a DHCP Decline packet to the server, and the client must begin the lease
process again.
DHCP Release
A DHCP client sends a DHCP Release packet to the server to release the IP
address and cancel any remaining lease.
DHCP Inform
DHCP Inform is a new DHCP message type, defined in RFC 2131, used by
computers on the network to request and obtain information from a DHCP
server for use in their local configuration. When this message type is used, the
sender is already externally configured for its IP address on the network, which
may or may not have been obtained using DHCP. This message type is not
currently supported by the DHCP service provided in earlier versions of
Windows NT Server and may not be recognized by third-party implementations
of DHCP software.
Notes 1 - DHCP Server Configuration
6/8
Gnall
DHCP Server Configuration
DHCP Terminology
Scope
Microsoft defines scope as the range of IP addresses managed by a DHCP server along with the
information associated with that range, such as addresses for various servers (WINS, DNS, …) in
the network.
Microsoft recommends that a Windows DHCP server service no more than 10,000 clients.
Exclusions
A scope is usually defined by specifying the full range of the subnet, and then excluding a portion
of that range for IP addresses which are assigned statically, such as the IP address for the DHCP
server managing the scope and other important servers.
Reservations
IP address assignments and other DHCP options can be reserved for specific machines via a
machine's MAC address. One can think of (MAC) reservations as a way of mimicking the RARP
table of a RARP/BOOTP server, in that RARP and BOOTP servers required all IP addresses to be
manually assigned to specific MAC addresses.
Can a reservation be
inside the excluded range?
Lease
The DHCP server usually doesn't give a DHCP client an IP address to use forever - there is usually
a time limit involved. As the life of the DHCP lease comes to an end, the client will check with the
DHCP server to see if it can continue to use the IP address it has been using.
Longer lease time are more suitable for stationary desktops while shorter lease times are more
suitable for transient laptops.
Options
In addition to an IP address, a DHCP server can also provide the DHCP client with the addresses of
the default gateway, WINS and DNS servers, etc. This information can be configured:
•
On a global/server level for all of the scopes managed by the DHCP server
•
On a scope level for each individual scope
•
On a MAC reservation level for each individual machine
Options set for individual scopes will override the global options set for all scopes managed by the
DHCP server, and options set for individual machines via MAC reservations will override those set
at the scope level. Individual DHCP clients can also locally override information received from the
DHCP server.
DNS server information is best specified at the global level, since it is usually the same for each
scope/subnet. This simplifies administration of the network.
For a Microsoft DHCP server, both the Server Options and Scope Options dialog boxes list about
62 possible options. However, most of these are not supported by a Microsoft DHCP client. These
DHCP options are provided in order to remain backward compatible with BOOTP.
When first configuring a scope for a new subnet, Windows Server's New Scope Wizard will request
specific scope information for that subnet.
Notes 1 - DHCP Server Configuration
7/8
Gnall
DHCP Fault Tolerance
DHCP Fault Tolerance - OPTIONAL
Caution should be taken to ensure that no two active DHCP servers be allowed to offer the exact same
IP address. Suppose two DHCP servers, Server1 and Server2, both offer the same IP address X to a
client, and the client accepts address X from Server1. Server2 may then try to offer address X again
to another client. If that second client accepts address X from Server2, then there will be two clients
with the same IP address on the same subnet. So care must be taken in deciding how IP addresses
are divvied up among multiple DHCP servers serving the same subnet.
Fault tolerance can be handled in several ways:
•
Split Scope - Multiple DHCP servers can have scopes configured for non-overlapping portions of the
same subnet. Leases and reservations are NOT synchronized between DHCP servers (need to confirm).
•
Failover - Multiple DHCP servers can have scopes configured for non-overlapping portions of the
same subnet. Leases and reservations ARE synchronized between DHCP servers (need to confirm).
•
A second fully redundant duplicate DHCP server waits in standby mode with its scope(s)
deactivated. If the active DHCP server fails, the standby DHCP server is ready to take over
immediately by activating its scope(s).
100/100 Failover
Design a subnet which contains twice as many IP addresses as required for the network and use that
same subnet for scopes assigned to two different DHCP servers. On the first DHCP server, assign the
first half of the subnet (exclude the second half). On the second DHCP server, assign the second half
of the subnet. If either DHCP server dies, then the remaining DHCP server has enough IP addresses to
serve all of the clients.
Example 1 - 100 DHCP Clients
Server 1
Scope:
Assign:
Exclude:
Server 2
Scope:
Assign:
Exclude:
192.168.0.1
192.168.0.1
- 192.168.0.254
-
192.168.0.126
- 192.168.0.254
192.168.0.126
- 192.168.0.254
- 192.168.0.254
192.168.0.1
192.168.0.1
-
/24
192.168.0.125
/24
192.168.0.125
Example 2 - 200 DHCP Clients
A network with 200 clients will require two contiguous /24 networks to be supernetted into one /23
network (512 IP addresses). The /23 subnet will then be split between the two DHCP servers.
The total subnet covers 510 host addresses, with the first DHCP server covering the first 255 host
addresses and the second DHCP server covering the second 255 host addresses.
Server 1
Scope:
Assign:
Exclude:
Server 2
Scope:
Assign:
Exclude:
192.168.0.1
192.168.0.1
- 192.168.1.254
-
192.168.1.0
- 192.168.1.254
192.168.1.0
- 192.168.1.254
- 192.168.1.254
192.168.0.1
192.168.0.1
Notes 1 - DHCP Fault Tolerance
-
/23
192.168.0.255
/23
192.168.0.255
8/8
Gnall