DHCP
Dynamic Host Configuration Protocol
Dynamic Host Configuration Protocol
-- DHCP - Networking protocol
 Obtains configuration information for operation in an Internet
Protocol network
 Used by network devices
 i.e. DHCP clients
 Can reduce system administration workload
 Allowing network to add devices with little or no manual
intervention
 Can reduce the number of IP addresses required for a network
Dynamic Host Configuration Protocol
DHCP
 Specifications:
 RFC 1531 initially defined DHCP as a standard-track protocol
 October 1993
 Succeeded the Bootstrap Protocol (BOOTP)
 RFC 2131 updated DHCP for Internet Protocol version 4
(IPv4) networks
 released in 1997
 RFC 3315 defined the extensions of DHCP for IPv6 (DHCPv6)
Technical overview
 DHCP automates network-parameter assignment to network
devices
 From one or more DHCP servers
 DHCP makes it easy to add new machines to the network
 Even for small networks
 May reduce number of IP addresses required for an organization
 E.g. laptops that may be off site don’t need an IP address
Technical overview
 When a DHCP-configured client connects to a network:
 computer or any other network-aware device
 DHCP client sends a broadcast query requesting necessary
information from a DHCP server
 DHCP server manages a pool of IP addresses and information about client
configuration parameters such as default gateway, domain name, the DNS
servers, other servers such as time servers, and so forth
 DHCP server assigns the requesting computer:
 an IP address
 a lease (length of time the allocation is valid)
 other IP configuration parameters, such as the subnet mask and the default
gateway
 Query typically initiated immediately after booting
 Must complete before the client can initiate IP-based
communication
Technical overview
 Depending on implementation, the DHCP server may have
three methods of allocating IP-addresses:
 dynamic allocation
 automatic allocation
 static allocation
Technical overview
 Dynamic Allocation:
 Network administrator:
 Assigns a range of IP addresses available to DHCP
 Client computers on the LAN:
 IP software configured:
 Request an IP address from the DHCP server
 During network initialization
 Request-and-grant process uses a lease concept
 Has a controllable time period
 Allows the DHCP server to reclaim (and later reallocate) IP addresses that are
not renewed
 Dynamic re-use of IP addresses
Technical overview
 Automatic Allocation:
 DHCP server permanently assigns a free IP address to a requesting
client from the range defined by the administrator
 Similar to dynamic allocation, except:
 DHCP server keeps a table of past IP address assignments
 Server can preferentially assign a client the same IP address that the client
previously had
Technical overview
 Static Allocation:
 DHCP server allocates an IP address based on a table
 Contains MAC address/IP address pairs
 Manually generated
 E.g. by a network administrator
 Only requesting clients with a MAC address listed in this table will
be allocated an IP address
 This feature is variously called:
 Static DHCP Assignment (DD-WRT)
 Fixed-address (in the dhcpd documentation)
 DHCP reservation or Static DHCP (Cisco/Linksys and Tomato)
 IP reservation or MAC/IP binding (various other router manufacturers)
 Note: not all routers support static allocation
Technical details
 DHCP uses two ports:
 67/udp for the server side
 68/udp for the client side
 same as the ports assigned by IANA for BOOTP
 DHCP operations fall into four basic phases:
 IP discovery
 IP lease offer
 IP request
 IP lease acknowledgment
DHCP Discovery
 Client broadcasts messages on the physical subnet to discover
available DHCP servers
 Network administrators can configure a local router to forward
DHCP packets to a DHCP server on a different subnet
 This client-implementation creates a User Datagram Protocol
(UDP) packet with the broadcast destination
 255.255.255.255
or
 Specific subnet broadcast address
DHCP Discovery
 A DHCP client can also request its last-known IP address
 If the client remains connected to a network for which this IP is
valid, the server might grant the request
 Otherwise, it depends whether the server is set up as
authoritative or not
 An authoritative server will deny the request
forcing the client ask for a new IP immediately
 A non-authoritative server simply ignores the request
 Leads to an implementation-dependent timeout for the client to give up
on the request and ask for a new IP address

DHCP offer
 When a DHCP server receives an IP lease request from a client, it:
 Reserves an IP address for the client
 Extends an IP lease offer by sending a DHCPOFFER message to the
client containing:





the client's MAC address
the IP address that the server is offering
the subnet mask
the lease duration
the IP address of the DHCP server making the offer
 Server determines the configuration based on the client's hardware
address as specified in the CHADDR (Client Hardware Address) field
 Here the server, 192.168.1.1, specifies the IP address in the
YIADDR (Your IP Address) field
DHCP request
 A client may receive DHCP offers from multiple servers
 Will only accept one DHCP offer
 Broadcast a DHCP request message for that offer
 Based on the Transaction ID field in the request
 Servers are informed whose offer the client has
accepted
 When other DHCP servers receive this message
 Withdraw any offers that they might have made to the client
 Return the offered address to the pool of available addresses
DHCP acknowledgment
 When the DHCP server receives the DHCPREQUEST message
from the client
 Configuration processes enters its final phase
 Acknowledgement phase involves sending a DHCPACK packet to the
client
 Packet includes
 lease duration
 any other configuration information that the client might have requested
 At this point, the IP configuration process is complete
 After the client obtains an IP address
 Client may use the Address Resolution Protocol (ARP) to prevent IP
conflicts caused by overlapping address pools of DHCP servers
DHCP information
 A DHCP client may request more information than the
server sent with the original DHCPOFFER
 The client may also request repeat data for a particular
application
 For example, browsers use DHCP Inform to obtain web proxy settings via
WPAD
 Such queries do not cause the DHCP server to refresh the IP
expiry time in its database
DHCP releasing
 Client
 Sends a request to the DHCP server to release the
DHCP information
 Deactivates its IP address
 Client devices usually do not know when users may
disconnect from the network
 Protocol does not mandate the sending of DHCP
Release
Client configuration parameters
 DHCP server can provide optional configuration parameters
to the client
 RFC 2132 describes the available DHCP options
 defined by Internet Assigned Numbers Authority (IANA)
 DHCP and BOOTP PARAMETERS
 DHCP client can select, manipulate and overwrite
parameters provided by a DHCP server
Options
 Option exists to identify vendor and functionality of a DHCP
client
 Variable-length string of characters or octets
 Meaning specified by the vendor of the DHCP client
 Vendor Class Identifier (VCI) (Option 60).
 Method a DHCP client can utilize to communicate to the server that it is
using a certain type of hardware or firmware is to set a value in its DHCP
requests
 Allows DHCP server to differentiate between the two kinds of client
machines
 e.g. process requests from two types of modems appropriately
 Some types of set-top boxes also set the VCI (Option 60) to inform
the DHCP server about the hardware type and functionality of the
device
 Gives the DHCP server a hint about any required extra information that this
client needs in a DHCP response
DHCP Relaying
 In small networks DHCP typically uses broadcasts
 In some circumstances, unicast addresses will be used
 For example: when networks have a single DHCP server that provides IP addresses for
multiple subnets
 When a router for such a subnet receives a DHCP broadcast
 it converts it to unicast
 with a destination MAC/IP address of the configured DHCP server, source
MAC/IP of the router itself
 GIADDR field of this modified request is populated with the IP address
of the router interface on which it received the original DHCP request
 GIAADDR: Gateway address
 DHCP server uses the GIADDR field to identify the subnet of the
originating device in order to select an IP address from the correct pool
 DHCP server then sends the DHCP OFFER back to the router via
unicast
 Router converts the DHCP OFFER back to a broadcast, sent out on the
interface of the original device
Security
 DHCP protocol became a standard before network security became
a significant issue:
 DHCP includes no security features
 Potentially vulnerable to two types of attacks:
 Unauthorized DHCP Servers:
 Since one cannot specify the server you want:
o an unauthorized server can respond to client requests
o sending client network configuration values that are beneficial to the
attacker
 As an example, a hacker can hijack the DHCP process to configure clients to
use a malicious DNS server or router
 Unauthorized DHCP Clients:
 By masquerading as a legitimate client, an unauthorized client can gain access
to network configuration and an IP address on a network it should otherwise
not be allowed to use
 By flooding the DHCP server with requests for IP addresses
o it is possible for an attacker to exhaust the pool of available IP addresses
o disrupting normal network activity (a denial of service attack)
Security
 RFC 3118 ("Authentication for DHCP Messages")
introduced authentication information into DHCP messages
 Allows clients and servers to reject information from invalid
sources
 Although support for this protocol is widespread:
 Large numbers of clients and servers still do not fully support
authentication
 Forces servers to support clients that do not support this feature
 As a result, other security measures are usually implemented
around the DHCP server (such as IPsec)
 Ensures that only authenticated clients and servers are granted access to
the network
Security
 Addresses should be dynamically linked to a secure DNS server
 Allows troubleshooting by name rather than by a potentially unknown
address
 Effective DHCP-DNS linkage requires having a file of either MAC
addresses or local names that will be sent to DNS that uniquely
identifies physical hosts, IP addresses, and other parameters such as
the default gateway, subnet mask, and IP addresses of DNS servers
from a DHCP server
 DHCP server ensures that all IP addresses are unique
 i.e. no IP address are assigned to a second client while the first client's
assignment is valid (its lease has not expired)
 IP address pool management is done by the server and not by a
network administrator
DHCP can:
A. Reduce the number of
30 sec
ad
ay
te
w
ga
0%
0%
dr
es
se
Al
...
lo
ft
he
ab
No
ov
ne
e
of
th
e
ab
ov
e
of
n
tio
lla
n
in
st
a
As
sig
th
e
0%
. ..
fI
.. .
be
ro
m
nu
se
E.
Ea
D.
1%
th
e
C.
Re
du
ce
B.
IP addresses required
in an organization
Ease the installation of
new computers
Assign gateway
addresses on clients
All of the above
None of the above
99%