DHCP

DHCP

1. Allocation of parameters to customers network automatically.

2. VS. Manual Configuration

   • Advantatges
     • Minimization of errors in the configuration of the network on the computers.
     • It facilitates maintenance.
       • When the IP address, the submask address or the DNS changes, this happens automatically in the server.
     • Provides configuration automatically.
     • Allows you to reuse addresses.
   • Disadvantatges
     • It is necessary to ensure the operation of the DHCP service.

3. Type of assignment

   • Manual
     • The IP address is associated with the client's MAC address.
   • Dynamic
     • The server offers a customer address for a limited time called lease time.
   • Permanent
     • The address assigned to the client is permanently associated, that is, it will give you unlimited time.

4. Details of the protocol

   • The server uses port 67 UDP and the client port 68 UDP.
     • The client computer uses a well-known port and not a normal port to prevent more than one client DHCP to the computer.
   • In the same network they can have more than one DHCP server.

5. DHCP client negotiation

   • Step #1: The client sends a DHCP DISCOVER by broadcast to the servers.
     • Step #2: The servers that offer this service respond to the DHCP DISCOVER message that the customer has launched with a DHCP OFFER.
       • Step #3: The client sends a DHCP REQUEST for broadcast requesting the connection to one of the specific DHCP servers among all the servers that DHCP OFFER has sent to him.
         • DHCP ACK: The DHCP server responds to the REQUEST with an ACK, that is, allows the client to start the connection.
         • DHCP NAK: The DHCP server responds to the REQUEST with a NAK, that is, it does not allow the client to start the connection.
   • Curiosities of the negotiation
     • To renew the leasing time, the client send a DHCP REQUEST to renew of the concession of the IP address.
     • Generally the clients send the renew before the lease time is over.
     • DHCP DECLINE: Notify the server that the client has detected that the assigned address is already in use.
     • DHCP RELEASE: When the client releases an address from the who had sent sends a DHCP release.

6. DHCP Servers

   • We can find them in ...
     • Routers
       • Routers have one DHCP server integrated.
     • Switchos level 3 (L3)
       • The most advanced switches (those of layer 3), also have an integrated DHCP server.
     • Servers
       • Both Windows Server and Linux can also offer DHCP services.
   • In these types of servers we will have the following options:
     • Address pool, which is the set of available addresses that can be offered.
     • Configuration of the gateway and the names services.
     • Concession time for dynamic allocations.
     • Lists to do static assignments.
   • Additional functions of DHCP servers
     • Creation of areas to manage several networks.
     • Interfaces for which you accept DHCP requests.
     • Advanced configurations, such as hourly service settings, proxies, mail servers, etc.
     • DHCP configuration for IPv6.

7. DHCP relay

   • Intermediary who receives DHCP requests from customers and redirects them to server, thus pending to use a DHCP server for several simultaneous networks, in addition to reducing the traffic in the network segment of the server.

8. Attacks on DHCP protocol

   • DHCP starvation
     • It consists of flooding the false DHCP request server so that there are no free addresses on the network. It is usually the first step to perform a DHCP rogue.
   • DHCP spoofing
     • DHCP rogue
       • An illegitimate DHCP server is used to configure the computers on the network. Allows the attacker to modify the client settings.
     • DHCP ACK injection
       • Intercept customer DHCP REQUEST packages and ACK are sent with the modified configuration. This attack only works if you respond faster than the DHCP server.
   • Contramesures
     • Snort
       • Unauthorized DHCP monitoring and detection tools.
     • DHCP Snooping
       • It consists of the switch blocking server messages in ports marked as untrusted.