1 / 23

DHCP

DHCP. Dynamic Host Configuration Protocol. Dynamic Host Configuration Protocol -- DHCP --. Networking protocol Obtains configuration information for operation in an Internet Protocol network Used by network devices i.e. DHCP clients Can reduce system administration workload

eliora
Download Presentation

DHCP

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. DHCP Dynamic Host Configuration Protocol

  2. Dynamic Host Configuration Protocol-- DHCP -- • Networking protocol • Obtains configuration information for operation in an Internet Protocol network • Used by network devices • i.e. DHCP clients • Can reduce system administration workload • Allowing network to add devices with little or no manual intervention • Can reduce the number of IP addresses required for a network

  3. Dynamic Host Configuration ProtocolDHCP • Specifications: • RFC 1531 initially defined DHCP as a standard-track protocol • October 1993 • Succeeded the Bootstrap Protocol (BOOTP) • RFC 2131 updated DHCP for Internet Protocol version 4 (IPv4) networks • released in 1997 • RFC 3315 defined the extensions of DHCP for IPv6 (DHCPv6)

  4. Technical overview • DHCP automates network-parameter assignment to network devices • From one or more DHCP servers • DHCP makes it easy to add new machines to the network • Even for small networks

  5. Technical overview • When a DHCP-configured client connects to a network: (a computer or any other network-aware device) • DHCP client sends a broadcast query requesting necessary information from a DHCP server • DHCP server manages a pool of IP addresses and information about client configuration parameters such as default gateway, domain name, the DNS servers, other servers such as time servers, and so forth • DHCP server assigns the requesting computer: • an IP address • a lease (length of time the allocation is valid) • other IP configuration parameters, such as the subnet mask and the default gateway • Query typically initiated immediately after booting • Must complete before the client can initiate IP-based communication

  6. Technical overview • Depending on implementation, the DHCP server may have three methods of allocating IP-addresses: • dynamic allocation • automatic allocation • static allocation

  7. Technical overview • Dynamic Allocation: • Network administrator: • Assigns a range of IP addresses available to DHCP • Client computers on the LAN: • IP software configured: • Request an IP address from the DHCP server • During network initialization • Request-and-grant process uses a lease concept • With a controllable time period • Allows the DHCP server to reclaim (and later reallocate) IP addresses that are not renewed (dynamic re-use of IP addresses)

  8. Technical overview • Automatic Allocation: • DHCP server permanently assigns a free IP address to a requesting client from the range defined by the administrator • Similar to dynamic allocation, except: • DHCP server keeps a table of past IP address assignments • Server can preferentially assign a client the same IP address that the client previously had

  9. Technical overview • Static Allocation: • DHCP server allocates an IP address based on a table • Contains MAC address/IP address pairs • Manually generated • E.g. by a network administrator • Only requesting clients with a MAC address listed in this table will be allocated an IP address • This feature is variously called: • Static DHCP Assignment (DD-WRT) • Fixed-address(in the dhcpd documentation) • DHCP reservation or Static DHCP (Cisco/Linksys and Tomato) • IP reservation or MAC/IP binding (various other router manufacturers) • Note: not all routers support static allocation

  10. Technical details • DHCP uses two ports: • 67/udp for the server side • 68/udp for the client side • same as the ports assigned by IANA for BOOTP • DHCP operations fall into four basic phases: • IP discovery • IP lease offer • IP request • IP lease acknowledgment

  11. DHCP Discovery • Client broadcasts messages on the physical subnet to discover available DHCP servers • Network administrators can configure a local router to forward DHCP packets to a DHCP server on a different subnet • This client-implementation creates a User Datagram Protocol (UDP) packet with the broadcast destination • 255.255.255.255 or • Specific subnet broadcast address

  12. DHCP Discovery • A DHCP client can also request its last-known IP address • If the client remains connected to a network for which this IP is valid, the server might grant the request • Otherwise, it depends whether the server is set up as authoritative or not • An authoritative server will deny the request • forcing the client ask for a new IP immediately • A non-authoritative server simply ignores the request • Leads to an implementation-dependent timeout for the client to give up on the request and ask for a new IP address

  13. DHCP offer • When a DHCP server receives an IP lease request from a client, it: • reserves an IP address for the client • extends an IP lease offer by sending a DHCPOFFER message to the client • This message contains • the client's MAC address • the IP address that the server is offering • the subnet mask • the lease duration • the IP address of the DHCP server making the offer • Server determines the configuration based on the client's hardware address as specified in the CHADDR (Client Hardware Address) field • Here the server, 192.168.1.1, specifies the IP address in the YIADDR (Your IP Address) field

  14. DHCP request • A client can receive DHCP offers from multiple servers • it will accept only one DHCP offer and broadcast a DHCP request message • Based on the Transaction ID field in the request • Servers are informed whose offer the client has accepted • When other DHCP servers receive this message • they withdraw any offers that they might have made to the client • return the offered address to the pool of available addresses

  15. DHCP acknowledgment • When the DHCP server receives the DHCPREQUEST message from the client • Configuration processes enters its final phase • Acknowledgement phase involves sending a DHCPACK packet to the client • Packet includes • lease duration • any other configuration information that the client might have requested • At this point, the IP configuration process is complete • After the client obtains an IP address • Client may use the Address Resolution Protocol (ARP) to prevent IP conflicts caused by overlapping address pools of DHCP servers

  16. DHCP information • A DHCP client may request more information than the server sent with the original DHCPOFFER • The client may also request repeat data for a particular application • For example, browsers use DHCP Inform to obtain web proxy settings via WPAD • Such queries do not cause the DHCP server to refresh the IP expiry time in its database

  17. DHCP releasing • Client • Sends a request to the DHCP server to release the DHCP information • Deactivates its IP address • Client devices usually do not know when users may disconnect from the network • Protocol does not mandate the sending of DHCP Release

  18. Client configuration parameters • DHCP server can provide optional configuration parameters to the client • RFC 2132 describes the available DHCP options • defined by Internet Assigned Numbers Authority (IANA) • DHCP and BOOTP PARAMETERS • DHCP client can select, manipulate and overwrite parameters provided by a DHCP server

  19. Options • Option exists to identify vendor and functionality of a DHCP client • Variable-length string of characters or octets • Meaning specified by the vendor of the DHCP client • Vendor Class Identifier (VCI) (Option 60). • Method a DHCP client can utilize to communicate to the server that it is using a certain type of hardware or firmware is to set a value in its DHCP requests • Allows DHCP server to differentiate between the two kinds of client machines • e.g. process requests from two types of modems appropriately • Some types of set-top boxes also set the VCI (Option 60) to inform the DHCP server about the hardware type and functionality of the device • Gives the DHCP server a hint about any required extra information that this client needs in a DHCP response

  20. DHCP Relaying • In small networks DHCP typically uses broadcasts • In some circumstances, unicast addresses will be used • For example: when networks have a single DHCP server that provides IP addresses for multiple subnets • When a router for such a subnet receives a DHCP broadcast • it converts it to unicast • with a destination MAC/IP address of the configured DHCP server, source MAC/IP of the router itself • GIADDR field of this modified request is populated with the IP address of the router interface on which it received the original DHCP request • DHCP server uses the GIADDR field to identify the subnet of the originating device in order to select an IP address from the correct pool • DHCP server then sends the DHCP OFFER back to the router via unicast • Router converts the DHCP OFFER back to a broadcast, sent out on the interface of the original device

  21. Security • DHCP protocol became a standard before network security became a significant issue: • DHCP includes no security features • Potentially vulnerable to two types of attacks: • Unauthorized DHCP Servers: • Since one cannot specify the server you want: • an unauthorized server can respond to client requests • sending client network configuration values that are beneficial to the attacker • As an example, a hacker can hijack the DHCP process to configure clients to use a malicious DNS server or router • Unauthorized DHCP Clients: • By masquerading as a legitimate client, an unauthorized client can gain access to network configuration and an IP address on a network it should otherwise not be allowed to use • By flooding the DHCP server with requests for IP addresses • it is possible for an attacker to exhaust the pool of available IP addresses • disrupting normal network activity (a denial of service attack)

  22. Security • RFC 3118 ("Authentication for DHCP Messages") introduced authentication information into DHCP messages • Allows clients and servers to reject information from invalid sources • Although support for this protocol is widespread: • Large numbers of clients and servers still do not fully support authentication • Forces servers to support clients that do not support this feature • As a result, other security measures are usually implemented around the DHCP server (such as IPsec) • Ensures that only authenticated clients and servers are granted access to the network

  23. Security • Addresses should be dynamically linked to a secure DNS server • Allows troubleshooting by name rather than by a potentially unknown address • Effective DHCP-DNS linkage requires having a file of either MAC addresses or local names that will be sent to DNS that uniquely identifies physical hosts, IP addresses, and other parameters such as the default gateway, subnet mask, and IP addresses of DNS servers from a DHCP server • DHCP server ensures that all IP addresses are unique • i.e. no IP address are assigned to a second client while the first client's assignment is valid (its lease has not expired) • IP address pool management is done by the server and not by a network administrator

More Related