HackBlue

Tools · Wireshark · 17 / 30

Reading DHCP

Discover, offer, request, ack. The message type is option 53, and the router and DNS options are the host’s new map.

12 min read · practice only with authorization

Four messages, one lease

A lab client with no address asks using DHCP. The exchange you want is discover, offer, request, and ack. The message type is option 53, dissected as dhcp.option.dhcp: 1 discover, 2 offer, 3 request, 5 ack. A nak is 6. Filter dhcp.option.dhcp == 5 when you only need the grants.

Discover and the early request are broadcasts. The client address is still 0.0.0.0, so the useful identity in those frames is dhcp.hw.mac_addr, the client hardware address. The address being granted is dhcp.ip.your in the offer and the ack. If you filter only on ip.src == 10.8.0.40 you will miss the discover, because the client did not have 10.8.0.40 yet.

Snippet
dhcp.option.dhcp == 1 || dhcp.option.dhcp == 2 || dhcp.option.dhcp == 3 || dhcp.option.dhcp == 5

The options are the configuration

The ack carries the map the host will use. dhcp.option.router is the gateway. dhcp.option.domain_name_server is the resolver. dhcp.option.dhcp_server_id is the server the client accepted. dhcp.option.subnet_mask is the mask. Those four fields explain the captures you will read afterward: the gateway the host ARPs for, and the resolver its DNS questions go to.

Two offers, from two server identifiers, mean two speakers answered. On a lab network that should have one DHCP server, a second dhcp.option.dhcp_server_id is the thing to write down. Identify it from the capture you were asked to take. The rest of the work belongs to whoever administers that segment.

Worked case: the workstation took a lease from the lab server

You start a capture on the lab segment, then renew the lease on 10.8.0.40. Frame 10 is a discover from hardware address 02:00:00:00:00:28. Frame 11 is an offer from 10.8.0.1, your address 10.8.0.40, server id 10.8.0.1. Frame 12 is the request, and frame 13 is the ack. The ack’s router option is 10.8.0.1 and the DNS option is 10.8.0.53.

Later DNS questions from 10.8.0.40 go to 10.8.0.53, which matches the option you just read. If they had gone somewhere else, the host’s map and its behavior would disagree, and you would have a note with both facts. One offer, one server id, one resolver: that is the baseline for this segment. A second offer in a future file is a change from this baseline.

What this file does not justify

Reading a lease on a network you administer is part of running that network. Answering DHCP yourself, on a segment you do not run, is not a lab. This lesson stops at the decode.

Older write-ups call the dissector bootp. Current Wireshark uses dhcp, and dhcp.option.dhcp is the message type. If a filter you typed from memory returns a red box, click a DHCP frame and copy the field name from the status bar.

Diagram

From a discover to the gateway and the resolver

  1. Discover

    Option 53 equals 1. The client hardware address is the identity. The IP source may be 0.0.0.0.

    Discovers
    dhcp.option.dhcp == 1
  2. Offer

    Option 53 equals 2. Read the offered address and the server identifier.

  3. Request

    The client names the offer it wants. Then the ack, option 53 equals 5, grants it.

  4. Map

    Record the router option and the DNS option. Later ARP and DNS should match them.

Check yourself

1. Which filter shows DHCP acks?

2. A discover shows source 0.0.0.0. How do you tell which lab machine asked?

3. Which fields in the ack explain the gateway and the resolver the host will use?