DHCP数据抓包分析--wireshark

DHCP数据抓包分析–wireshark

DHCP-(Dynamic Host Configuration Procotol,动态主机配置协议),是一个局域网的网络协议,主要用于给内部网络或网络服务供应商自动分匹配IP地址。属于TCP/IP协议,使用UDP进行工作。

DHCP有三个端口,其中UDP67UDP68为正常的DHCP服务端口,分别为DHCP ServerDHCP Client的服务窗口,546号端口用于DHCPv6 Client,而不是DHCPv4,是因为DHCP failover服务。该服务是需要特别开启的服务,用于做双击热备份。

作用

  • 保证任何统一时刻,同一局域网内只能由一台DHCP客户机所使用

  • DHCP可以给用户分配永久固定的IP地址

  • DHCP允许用其他方法获得IP地址的主机共存,如手动配置IP地址

  • DHCP服务器向所有的BOOTP客户端提供服务

DHCP的三种地址分配方式

  1. 自动分配:DHCP服务器给客户端分配永久性的IP地址
  2. 动态分配:DHCP给客户端分配的IP地址过一段时间之后会过期,或者客户端可以主动释放该地址
  3. 手动配置:由用户手动为客户端指定IP地址

DHCP工作流程

[外链图片转存失败,源站可能有防盗链机制,建议将图片保存下来直接上传(img-PM9QxKAR-1601874581178)(picture/pIYBAFqeZ5qAXTeOAABeE14sdKY128.jpg)]

  1. 发现阶段,即DHCP客户端寻找DHCP服务器的阶段。DHCP客户端以广播的方式发送DHCP Discover包,来寻找DHCP服务器,即向地址255.255.255.255发送广播信息,网络上所有装有TCP/IP协议的主机都会接收到该广播信息,但是只有DHCP服务器才会做出响应。

  2. 提供阶段:DHCP服务器提供地址的阶段,所有接收到请求的服务器都会从地址池中选一个IP地址给客户端。

  3. 选择阶段:即DHCP从接收到的所有DHCP提供的IP地址中选择一个IP地址的过程,广播方式传输,这样所有DHCP服务器就直到了他选择了哪个DHCP服务器提供的地址。

  4. 确认阶段:即DHCP服务器确认所提供的IP地址阶段。当DHCP服务器收到客户端发送的DHCP Request请求信息之后,便向DHCP客户端发送一个包含所提供的IP地址和其他设置的DHCP Ack

Linux上抓DHCP报文

开启wireshark开始抓包,然后在命令行上使用以下命令重新获取IP地址

# 释放对应网卡上的IP地址
$ sudo dhclient -r wlp4s0
# 指定网卡使用`DHCP`获取IP地址
$ sudo dhclient  wlp4s0

或者在简单点,但是这样做需要足够快,因为网卡禁用之后就无法使用wireshark进行抓包了,所以需要拉网同的同时赶快开始抓包,能不能抓到就看手速了 😹

# 下网卡
ifconfig wlp4s0 down
# 上网卡
ifconfig wlp4s0 up

DHCP报文格式

   0                   1                   2                   3
   0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |     op (1)    |   htype (1)   |   hlen (1)    |   hops (1)    |
   +---------------+---------------+---------------+---------------+
   |                            xid (4)                            |
   +-------------------------------+-------------------------------+
   |           secs (2)            |           flags (2)           |
   +-------------------------------+-------------------------------+
   |                          ciaddr  (4)                          |
   +---------------------------------------------------------------+
   |                          yiaddr  (4)                          |
   +---------------------------------------------------------------+
   |                          siaddr  (4)                          |
   +---------------------------------------------------------------+
   |                          giaddr  (4)                          |
   +---------------------------------------------------------------+
   |                                                               |
   |                          chaddr  (16)                         |
   |                                                               |
   |                                                               |
   +---------------------------------------------------------------+
   |                                                               |
   |                          sname   (64)                         |
   +---------------------------------------------------------------+
   |                                                               |
   |                          file    (128)                        |
   +---------------------------------------------------------------+
   |                                                               |
   |                          options (variable)                   |
   +---------------------------------------------------------------+
  • op: 报文的操作类型,分为请求报文和响应报文,1请求报文,2为响应报文,具体的报文类型在options字段中标识
  • htype: DHCP客户端的硬件地址类型1表示是ethernet地址
  • hlen: DHCP客户端的硬件地址长度
  • hops: DHCP报文经过的DHCP中继的数目。初始为0,报文每经过一个DHCP中继,该字段就会增加1
  • xid: 客户端发起一次请求时选择的随机数,用来标识一次地址请求过程
  • secs: DHCP客户端开始DHCP请求后所经过的时间,目前未使用,固定为0
  • flags: DHCP服务器相应报文是采用单播还是广播方式发送,只使用第0位比特位,0表示采用单播方式,1表示采用广播方式,其余比特位保留不用
  • ciaddrDHCP客户端的IP地址
  • yiaddrDHCP服务器分配给客户端的IP地址
  • siaddrDHCP客户端获取IP地址等信息的服务器IP地址
  • giaddrDHCP客户端发送请求报文后经过的第一个DHCP中继的IP地址
  • chaddrDHCP客户端的硬件地址
  • snameDHCP客户端获取IP地址等信息的服务器名称
  • fileDHCP服务器为DHCP客户端指定的启动配置文件名称及路径信息。
  • options:可选变长字段选项字段,包含报文的类型、有效租期、DNS服务器的IP地址和WINS服务器的IP地址等配置信息。

DHCP报文类型

​ – 来自wireshark数据包分析

DHCP报文类型描述
DHCP DiscoverDHCP Discover DHCP客户端请求地址时,并不知道DHCP服务器的位置,因此DHCP客户端会在本地网络内以广播方式发送请求报文,这个报文成为Discover报文,目的是发现网络中的DHCP服务器,所有收到Discover报文的DHCP服务器都会发送回应报文,DHCP客户端据此就可以知道网络中存在的DHCP服务器的位置。
DHCP OfferDHCP Offer DHCP服务器收到Discover报文后,就会在所配置的地址池中查找一个合适的ip地址,加上相应的租约期限和其他配置信息(网关,DNS服务器等),构造一个Offer报文,发送给客户,告知用户本服务器可以为其提供IP地址。(只是告诉client可以提供,是预分配,还需要client通过ARP检测该IP是否重复)
DHCP RequestDHCP Request DHCP客户端会收到很多Offer,所以必须在这些回应中选择一个。Client通常选择第一个回应Offer报文的服务器作为自己的目标服务器,并回应一个广播Request报文,通告选择的服务器。DHCP客户端成功获取IP地址后,在地址使用租期过去1/2时,会向DHCP服务器发送单播Request报文续延租期,如果没有收到DHCP ACK报文,在租期过去3/4时,发送广播Request报文续延租期。
DHCP ACKDHCP ACK DHCP服务器收到Request报文后,根据Request报文中携带的用户MAC来查找有没有相应的续约记录,如果有则发送ACK报文作为回应,通知用户可以使用分配的ip地址
DHCP NAKDHCP NAK 如果DHCP服务器收到Request报文后,没有发现相应的租约记录或者由于某些原因无法正常分配ip地址,则发送ACK报文作为回应,通知用户无法分配合适的ip地址。
DHCP ReleaseDHCP Release 当用户不在需要使用分配ip地址时,就会向DHCP服务器发送Release报文,告知服务器用户不再需要分配ip地址,DHCP服务器会释放被绑定的租约。
DHCP DeclineDHCP Decline DHCP客户端收到DHCP服务器回应的ACK报文后,通过地址冲突检测发现服务器分配的地址冲突或者由于其他原因导致不能使用,则发送Decline报文,通知服务器所分配的ip地址不可用。
DHCP InformDHCP Inform DHCP客户端如果需要从DHCP服务器端获取更为详细的配置信息,则发送Inform报文向服务器进行请求,服务器收到该报文后,将根据租约进行查找,找到相应的配置信息后,发送ACK报文回应DHCP客户端(极少用到)。

以下是整个DHCP正常交互的过程

# 1. 首先发送 发现包
Frame 68: 342 bytes on wire (2736 bits), 342 bytes captured (2736 bits) on interface wlp4s0, id 0
# ff:ff:ff:ff:ff:ff MAC地址采用广播的形式
Ethernet II, Src: Chongqin_e1:18:a9 (40:23:43:e1:18:a9), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
# 255.255.255.255 IP地址采用广播的形式
Internet Protocol Version 4, Src: 0.0.0.0, Dst: 255.255.255.255
User Datagram Protocol, Src Port: 68, Dst Port: 67
Dynamic Host Configuration Protocol (Discover)
    Message type: Boot Request (1)
    Hardware type: Ethernet (0x01)
    Hardware address length: 6
    Hops: 0
    Transaction ID: 0x2e2bec50
    Seconds elapsed: 0
    Bootp flags: 0x0000 (Unicast)
        0... .... .... .... = Broadcast flag: Unicast
        .000 0000 0000 0000 = Reserved flags: 0x0000
    Client IP address: 0.0.0.0
    Your (client) IP address: 0.0.0.0
    Next server IP address: 0.0.0.0
    Relay agent IP address: 0.0.0.0
    Client MAC address: Chongqin_e1:18:a9 (40:23:43:e1:18:a9)
    Client hardware address padding: 00000000000000000000
    Server host name not given
    Boot file name not given
    Magic cookie: DHCP
    Option: (53) DHCP Message Type (Discover)
        Length: 1
        DHCP: Discover (1)
    Option: (12) Host Name
        Length: 14
        Host Name: andrew-G3-3590
    Option: (55) Parameter Request List
        Length: 13
        Parameter Request List Item: (1) Subnet Mask
        Parameter Request List Item: (28) Broadcast Address
        Parameter Request List Item: (2) Time Offset
        Parameter Request List Item: (3) Router
        Parameter Request List Item: (15) Domain Name
        Parameter Request List Item: (6) Domain Name Server
        Parameter Request List Item: (119) Domain Search
        Parameter Request List Item: (12) Host Name
        Parameter Request List Item: (44) NetBIOS over TCP/IP Name Server
        Parameter Request List Item: (47) NetBIOS over TCP/IP Scope
        Parameter Request List Item: (26) Interface MTU
        Parameter Request List Item: (121) Classless Static Route
        Parameter Request List Item: (42) Network Time Protocol Servers
    Option: (255) End
        Option End: 255
    Padding: 000000000000000000000000000000000000000000000000…

No.     Time           Source                Destination           Protocol Length Info
     69 0.003566600    192.168.199.1         192.168.199.235       DHCP     342    DHCP Offer    - Transaction ID 0x2e2bec50
# 2. 服务器发送 offer包
Frame 69: 342 bytes on wire (2736 bits), 342 bytes captured (2736 bits) on interface wlp4s0, id 0
# MAC地址 指定 Chongqin_e1:18:a9
Ethernet II, Src: HIWIFI_65:b0:40 (d4:ee:07:65:b0:40), Dst: Chongqin_e1:18:a9 (40:23:43:e1:18:a9)
# 正常的IP地址会指向 255.255.255.255 但是由于我这里抓包的时候,不是释放之后抓奥,而是使用程序重新获取的IP地址,所以服务器直接将offer包发废了设备的老的IP地址
Internet Protocol Version 4, Src: 192.168.199.1, Dst: 192.168.199.235
User Datagram Protocol, Src Port: 67, Dst Port: 68
Dynamic Host Configuration Protocol (Offer)
    Message type: Boot Reply (2)
    Hardware type: Ethernet (0x01)
    Hardware address length: 6
    Hops: 0
    Transaction ID: 0x2e2bec50
    Seconds elapsed: 0
    Bootp flags: 0x0000 (Unicast)
        0... .... .... .... = Broadcast flag: Unicast
        .000 0000 0000 0000 = Reserved flags: 0x0000
    Client IP address: 0.0.0.0
    Your (client) IP address: 192.168.199.235
    Next server IP address: 192.168.199.1
    Relay agent IP address: 0.0.0.0
    Client MAC address: Chongqin_e1:18:a9 (40:23:43:e1:18:a9)
    Client hardware address padding: 00000000000000000000
    Server host name not given
    Boot file name not given
    Magic cookie: DHCP
    Option: (53) DHCP Message Type (Offer)
        Length: 1
        DHCP: Offer (2)
    Option: (54) DHCP Server Identifier (192.168.199.1)
        Length: 4
        DHCP Server Identifier: 192.168.199.1
    Option: (51) IP Address Lease Time
        Length: 4
        IP Address Lease Time: (43200s) 12 hours
    Option: (58) Renewal Time Value
        Length: 4
        Renewal Time Value: (21600s) 6 hours
    Option: (59) Rebinding Time Value
        Length: 4
        Rebinding Time Value: (37800s) 10 hours, 30 minutes
    Option: (1) Subnet Mask (255.255.255.0)
        Length: 4
        Subnet Mask: 255.255.255.0
    Option: (28) Broadcast Address (192.168.199.255)
        Length: 4
        Broadcast Address: 192.168.199.255
    Option: (3) Router
        Length: 4
        Router: 192.168.199.1
    Option: (6) Domain Name Server
        Length: 4
        Domain Name Server: 192.168.199.1
    Option: (15) Domain Name
        Length: 3
        Domain Name: lan
    Option: (255) End
        Option End: 255
    Padding: 000000

No.     Time           Source                Destination           Protocol Length Info
     70 0.000447243    0.0.0.0               255.255.255.255       DHCP     342    DHCP Request  - Transaction ID 0x2e2bec50
# 客户端接受一个IP地址之后 胡以广播的方式 告知接受服务器提供的IP地址信息
Frame 70: 342 bytes on wire (2736 bits), 342 bytes captured (2736 bits) on interface wlp4s0, id 0
Ethernet II, Src: Chongqin_e1:18:a9 (40:23:43:e1:18:a9), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 0.0.0.0, Dst: 255.255.255.255
User Datagram Protocol, Src Port: 68, Dst Port: 67
Dynamic Host Configuration Protocol (Request)
    Message type: Boot Request (1)
    Hardware type: Ethernet (0x01)
    Hardware address length: 6
    Hops: 0
    Transaction ID: 0x2e2bec50
    Seconds elapsed: 0
    Bootp flags: 0x0000 (Unicast)
        0... .... .... .... = Broadcast flag: Unicast
        .000 0000 0000 0000 = Reserved flags: 0x0000
    Client IP address: 0.0.0.0
    Your (client) IP address: 0.0.0.0
    Next server IP address: 0.0.0.0
    Relay agent IP address: 0.0.0.0
    Client MAC address: Chongqin_e1:18:a9 (40:23:43:e1:18:a9)
    Client hardware address padding: 00000000000000000000
    Server host name not given
    Boot file name not given
    Magic cookie: DHCP
    Option: (53) DHCP Message Type (Request)
        Length: 1
        DHCP: Request (3)
    Option: (54) DHCP Server Identifier (192.168.199.1)
        Length: 4
        DHCP Server Identifier: 192.168.199.1
    Option: (50) Requested IP Address (192.168.199.235)
        Length: 4
        Requested IP Address: 192.168.199.235
    Option: (12) Host Name
        Length: 14
        Host Name: andrew-G3-3590
    Option: (55) Parameter Request List
        Length: 13
        Parameter Request List Item: (1) Subnet Mask
        Parameter Request List Item: (28) Broadcast Address
        Parameter Request List Item: (2) Time Offset
        Parameter Request List Item: (3) Router
        Parameter Request List Item: (15) Domain Name
        Parameter Request List Item: (6) Domain Name Server
        Parameter Request List Item: (119) Domain Search
        Parameter Request List Item: (12) Host Name
        Parameter Request List Item: (44) NetBIOS over TCP/IP Name Server
        Parameter Request List Item: (47) NetBIOS over TCP/IP Scope
        Parameter Request List Item: (26) Interface MTU
        Parameter Request List Item: (121) Classless Static Route
        Parameter Request List Item: (42) Network Time Protocol Servers
    Option: (255) End
        Option End: 255
    Padding: 00000000000000000000000000

No.     Time           Source                Destination           Protocol Length Info
     71 0.005910802    192.168.199.1         192.168.199.235       DHCP     355    DHCP ACK      - Transaction ID 0x2e2bec50
# 服务器确认接受的是自己提供的IP地址之后  会向客户端回复ACK
Frame 71: 355 bytes on wire (2840 bits), 355 bytes captured (2840 bits) on interface wlp4s0, id 0
Ethernet II, Src: HIWIFI_65:b0:40 (d4:ee:07:65:b0:40), Dst: Chongqin_e1:18:a9 (40:23:43:e1:18:a9)
Internet Protocol Version 4, Src: 192.168.199.1, Dst: 192.168.199.235
User Datagram Protocol, Src Port: 67, Dst Port: 68
Dynamic Host Configuration Protocol (ACK)
    Message type: Boot Reply (2)
    Hardware type: Ethernet (0x01)
    Hardware address length: 6
    Hops: 0
    Transaction ID: 0x2e2bec50
    Seconds elapsed: 0
    Bootp flags: 0x0000 (Unicast)
        0... .... .... .... = Broadcast flag: Unicast
        .000 0000 0000 0000 = Reserved flags: 0x0000
    Client IP address: 0.0.0.0
    Your (client) IP address: 192.168.199.235
    Next server IP address: 192.168.199.1
    Relay agent IP address: 0.0.0.0
    Client MAC address: Chongqin_e1:18:a9 (40:23:43:e1:18:a9)
    Client hardware address padding: 00000000000000000000
    Server host name not given
    Boot file name not given
    Magic cookie: DHCP
    Option: (53) DHCP Message Type (ACK)
        Length: 1
        DHCP: ACK (5)
    Option: (54) DHCP Server Identifier (192.168.199.1)
        Length: 4
        DHCP Server Identifier: 192.168.199.1
    Option: (51) IP Address Lease Time
        Length: 4
        IP Address Lease Time: (43200s) 12 hours
    Option: (58) Renewal Time Value
        Length: 4
        Renewal Time Value: (21600s) 6 hours
    Option: (59) Rebinding Time Value
        Length: 4
        Rebinding Time Value: (37800s) 10 hours, 30 minutes
    Option: (1) Subnet Mask (255.255.255.0)
        Length: 4
        Subnet Mask: 255.255.255.0
    Option: (28) Broadcast Address (192.168.199.255)
        Length: 4
        Broadcast Address: 192.168.199.255
    Option: (3) Router
        Length: 4
        Router: 192.168.199.1
    Option: (6) Domain Name Server
        Length: 4
        Domain Name Server: 192.168.199.1
    Option: (15) Domain Name
        Length: 3
        Domain Name: lan
    Option: (12) Host Name
        Length: 14
        Host Name: andrew-G3-3590
    Option: (255) End
        Option End: 255
已标记关键词 清除标记
相关推荐
©️2020 CSDN 皮肤主题: 技术黑板 设计师:CSDN官方博客 返回首页
实付 9.90元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、C币套餐、付费专栏及课程。

余额充值