DHCP交互報(bào)文分析

DHCP交互報(bào)文分析DHCP簡(jiǎn)單介紹DHCP（DynamicHostConfigurationProtocol，動(dòng)態(tài)主機(jī)配置協(xié)議）是一個(gè)局域網(wǎng)的網(wǎng)絡(luò)協(xié)議，使用UDP協(xié)議工作，主要有兩個(gè)用途：給內(nèi)部網(wǎng)絡(luò)或網(wǎng)絡(luò)服務(wù)供應(yīng)商自動(dòng)分配IP地址，給用戶或者內(nèi)部網(wǎng)絡(luò)管理員作為對(duì)所有計(jì)算機(jī)作中央管理的手段，在RFC2131中有詳細(xì)的描述。DHCP有3個(gè)端口，其中UDP67和UDP68為正常的DHCP服務(wù)端口，分別作為DHCPServer和DHCPClient的服務(wù)端口；546號(hào)端口用于DHCPv6Client，而不用于DHCPv4,是為DHCPfailover服務(wù)，這是需要特別開(kāi)啟的服務(wù)，DHCPfailover是用來(lái)做“雙機(jī)熱備”的。DHCP協(xié)議前身為bootp協(xié)議，故使用抓包軟件過(guò)濾時(shí)過(guò)濾協(xié)議為：bootpDHCP交互過(guò)程如圖DHCP報(bào)文交互過(guò)程分析DHCPDiscover客戶端請(qǐng)求報(bào)文此過(guò)程主要為客戶端用戶尋找DHCP服務(wù)器過(guò)程，此時(shí)客戶機(jī)沒(méi)有IP地址向全網(wǎng)發(fā)送廣播報(bào)文，等待DHCP服務(wù)的回應(yīng)，只有裝有DHCP服務(wù)器的主機(jī)才能響應(yīng)此報(bào)文DHCP服務(wù)器接收到discover請(qǐng)求后，會(huì)向客戶端發(fā)出DHCPOffer報(bào)文作為回應(yīng)，該報(bào)文包含該DHCP服務(wù)器可向DHCP客戶端提供的IP地址以及該DHCP服務(wù)器自己的IP地址信息2551.4157325^0.41^?2606.42253OTTI?uru0,2551.4157325^0.41^?2606.42253OTTI?uru0,Q.0.0.0.025S.Z55.255.Z552S5.255.255-255255.255-255-255DHCPDHCPDHCPDH€PDFfCF1DlbCOV^r342DHCPDiscover342DHCPDiscover-TransactionidOx&fQaf-TransactionIDOx肝胸-TtansactionTDOicEf9a1?TransactionID0x15?Frame53:巴2初嚴(yán)總勺o(hù)n*i~ii?已(2?WE自弓匚呂ptu廠自on~irrtE『fN匚日0?EthernetII」ST：; fbbi'Ztj;曹H?Dst： iff卡Jl+limerrieiPiroiXoTVErsdwi斗.「列匸：0?0,0?0f(??Q?O■時(shí).仍工：巧5?255?冨5,2巧〔255?255?LtlUserDatagramProrocDl,￡rcPort:booTpc(63)?OstPort:bootps(67)□Bwtwt廠證pP廠口芯口七?1Messagetype;BootRequest(1) Harc^areType:ETheiririeT(0x01)— 機(jī)！&容戶常無(wú)iPiGilh貢送廣篙報(bào)文Hardwareaddress1engrh:6如果無(wú)響應(yīng)報(bào)文，則客戶端會(huì)持續(xù)發(fā)送Discover報(bào)文Secondelapsed為下一次發(fā)送discover報(bào)文的時(shí)間：46246253T.246B4hChthO47|_2_529-_2^955_pfcChCLQ454口544.397160-0-0.0嚀.利仃只耳1n.n.n.cDHCP342DHCPDiscover-Transa匚tionID0xd7a627adDtKP342DMCPDiscover-TrartsactionIDoxdra^zadDHCP342DmCPDi5cover-TrartsactionIDDxd?a627adITHTPHHFP-Tr^r*sflrTinriiTHn^Afq^q?7fiFraimEtheiInreiUserBaorjMeksjigttype；bootRcquesrCl)HsrdwaLretype;Ethernet(OkOI)Hardwareaddresslength:6Heps:0TitansacrlonIDFraimEtheiInreiUserBaorjMeksjigttype；bootRcquesrCl)HsrdwaLretype;Ethernet(OkOI)Hardwareaddresslength:6Heps:0TitansacrlonID：0xd7B627adLt1勺芒匚ciind百 ■芒d:n^tII..Src:50]7bs^d:0031bs0c(SO:?bs9d300:1b:0c)aDst:Braadcas-t{ff3ff:ff:ff3ff:ff3TIE蒼Prar00:01Version44SrcsCh0-0-0(ChCLCL0),DSI：：255?255?：255?；255(255.255.2&5u255)□a€agranProtocol,￡rcPort:baorp匚(五目)Lt1勺芒匚ciind百 ■芒d:DHCPOffer服務(wù)器響應(yīng)報(bào)文DHCP客戶端會(huì)選擇最先接收到的DHCPOffer進(jìn)行處理，并以廣播的形式發(fā)送DHCPRequest報(bào)文，該報(bào)文會(huì)加入對(duì)應(yīng)DHCP服務(wù)器的地址以及所需要的IPDHCP服務(wù)器收到Discover報(bào)文后，就會(huì)在所配置的地址池中查找一個(gè)合適的IP地址，加上相應(yīng)的租約期限和其他配置信息（如網(wǎng)關(guān)、DNS服務(wù)器等），構(gòu)造一個(gè)Offer報(bào)文，發(fā)送給用戶，告知用戶本服務(wù)器可以為其提供IP地址。＜只是告訴client可以提供，是預(yù)分配，還需要client通過(guò)ARP檢測(cè)該IP是否重復(fù)〉ir1田Frame5斗：工4mtjyrE：sDniaHfe￡2丁耳6 342byrE￡taptLiF電呂(2726ir1田Frame5斗：工4mtjyrE：sDniaHfe￡2丁耳6 342byrE￡taptLiF電呂(2726丘1瓷嚀)on"InTE『~Fac?己0uelher叮亡1工工」占『€；￥伽迅1‘p一cf:詳：也f口0：0君：？q：廣廣：理門：斤￡\>3InternetProtocolVersion4rS「t; 乳”10(1朋W.1D)；,0航；10E,%監(jiān)UEBWdOR刁UserOatagraHProtocoleSrcPort:bnotps|<67)tQBootstrapProtocol□st：與c：2b=號(hào)cLCupii）：n匚boutpcTfiU協(xié)論淵口勿37.68酣為響應(yīng)|曲越濡求Messagerypei旦ncn: (2)HardereType；trh^rrwi(DxOl)Hardwareaddresslength;6Hops*:QTransacT?ionID:0x00156dle5亡匚onds 0gBoetpflags:OxDOOO(Unicast)匸"l-jiant:IPadd廠ees:ClO?0,D(CkCLCLCQ ；——-—— |tdu「電nt)TP 呂■:ZLKB-弓.弓.ILD2(即&.巴■弓.丄口？)I 口口亡口只購(gòu)器的I緒客戸粕邙P地址Smac:002c.29cfJ06-￡l5D7hgdOa.IbOt3IIP!188.3.3.10目的I巳188.3.3.1D3Nextserverifaddress:0,0,DrD(orQrQ,o>Relayag^entIPaddress；0,0,0.0(D.CKChO〉 I匸TiEirtIMAC初擊卒號(hào)；$0;比；期；00;lb;Oc(50;『b;9d;00:;lb;0f〕~|——-|5F戶議船的凱劉!址C71enrhard^'areaddresspadding:serverliastranienorgivenbodlfil=enarncnorgivenMagiccaakie;DHCP\ 卩曲dhcp毗55臥芒阻Length；1DHCP;OfferC2)Bdpt"ion器［54jDHCP 廠卞芒廠 電『LEngih:4IDU“5^『\吃『工^包門匸!！"j趕「：1：83］監(jiān)乳10CL垂8■乳3：.10）1FOption;[51JIPAddressLeaseTimel-ajigtilrud IPAddressLeaseTine:(600s>IQminutesdpi："ion:(1)宮口已T啊通5kUriqth：』ffi國(guó)ElSubrnetMask:255-^255..tip ~(15^)DamaTTrhameaprian:(3)Rcmrsr-w oprion:(6)DOfflilnserverDHCPRequest客戶端回復(fù)報(bào)文DHCP服務(wù)器接收到DHCPRequest報(bào)文后，會(huì)判斷報(bào)文中的服務(wù)器IP是否與自己相同。如果不同，不做任何處理，只清除相應(yīng)的IP分配記錄；如果相同，服務(wù)器會(huì)向客戶端發(fā)送ACK報(bào)文，確認(rèn)可以使用，并且附上相應(yīng)的租期川552747.159?9.U.U.U1,U352DHCPRequestTransa匚tiionIDQxlS^dlEDHCP56町4Q1I5B4空 ISSTJTJTTKE：~JTiTmTi口Ticmro口HAFfflF PCXPE：匚PEXTiE川552747.159?9.U.U.U1,U352DHCPRequestTransa匚tiionIDQxlS^dlEDHCP56町4Q1I5B4空 ISSTJTJTTKE：~JTiTmTi口Ticmro口HAFfflF PCXPE：匚PEXTiE：匚辺DHCPACK3j4TransiactionIDQxl56dle『芒*匚十dFrame55:35Zbwesonwire(2316bit>Xjibytescaptured(2BL5bixs)oninterfaceDDHCPP55.255.亦⑺5.255.冇乩P55)riboaips-(67)尚未羽到iPH!址客戶'蜩Hfttmuuuuuuuuuuuuuuuuuouusss5S目BBBAllrJH3---'IJ?歸DHCPMessageTypeClientidentifierRequestedIPAddressDHCPServerIdenfifierHostNaniieCliemFully-QualifiedDomainiNarfteVendorclassidentifierParameterfteque^tList1遙報(bào)文丸廣區(qū)出￡1￡1□Bciarsrrapprorocoll(53)C61)C50)CW)(12)(31)(6D)間(255)EndMessaget^pe:Boornequcsr.(1JHardwarerype:EiherneT(OxOljiHardwareaddresslength;五Hops;0TransactionID;0x001SfidleSecondselap&ed:0Eocitpf"IagJ:OicODOClflUrTifast:、clienrIPaddress:□□0.0.05.CLCL0)$Gur~(匚IP耳閔「€宜呂：ChQ.Q-0go-CLD')InterrterProrocolVer^kjrT]4,￡rc：!0,0.0.usercaragi1anPiro-rcKoll3NextserverIPaddress:0.0.0.0(D.D.D.D)fte1ayagentIPaddress:!G.Q.0.0(D.D.D.D)|匚1ienrmacaddr#ss750^7b!!00!lb^DeC50i7b!gdiOO:lb":clienrhardwareaaoresspaddlnq：serverhostna?enorgivenBiootfilen^nenorgivenMagiccookie;D*KPOpticn;Option:Option:Option:OptionsOption:Option:Option:□piioni：Etherrtcr11.,|弓「u Th:gKiOO:Hb:D匸｛汨:池遼時(shí)泊口：曲羊匚｝,|Dst:Broadcast(ff:ff:ff:ffTff:ff)tpariibooip匚DHCPACK服務(wù)器發(fā)出的確認(rèn)報(bào)文DHCP客戶端接收到ACK信息后，會(huì)檢查該IP是否能夠使用，如果可以就直接使用該IP572750,29759-168.3,3.102255.255^255.255255.255.255.255DHCPDHCPJ4：2DHCPinfom-TransactionIPQi(49f6^5143^2DHCPInfora572750,29759-168.3,3.102255.255^255.255255.255.255.255DHCPDHCPJ4：2DHCPinfom-TransactionIPQi(49f6^5143^2DHCPInfora-TransactlanIDQx49f6d514Frane56:3412byresonwire(2756bits),342bwescaptured<2736bits)oninterfaceoEthernetII,￡rc:Vnware_cf!40:64(00：Dc：2g：cf!40!&?),Ck；T!soirbigd^oa^ibia.:(5D!7b：9d：QO：lb![]4：)inTernecproiocolversion4fsre:19fi.3.3.10(10B.3.3.10：1PMT：186/3.3,102Cl88,3.3.IPS)582753?2￡6211呂B?2?乳102in5『匚Port;■ Pi田m田User[>atagrai?ProtSEootstrapProtcuzolMessagetvp€：|Ed□亡￡皂口~1￥(2〕 $hardwarerype!Ethernet ■匕一Hardware且ddresslengrh:6 極口扌収標(biāo)4Hopi：0TransactioniID;OjtQOlSGcilE5-￡CDiridselaps-ed:0l±Boorpflags!OsDODO(Lin1匚耳呂t)t"ITmint工戸白出弓：CkCkO.◎fikO-O.CI] Ivour1門応曲)hp抑曲已巧：d嗣W.l呢 3門「:1。2)INextserverIPaddress;D-r0.0,0(0.0,0,0)RelayagentIPaddressz0-.0.0-0CO.G-0-0)丼史臣心matftf交目的F1.matserverhostnamenorgivenBootfileniarenotgivenMagiccookie:DHCPOption:(5-3)DHCPMessageTypeflprlon:(54)DhCPserverIdenrifier.oprion:(51)ipAddress-LeaseTime—■—i+i±m(xù)lloprIon:⑴subneiMaskvFTk

田Option;Option:Aprion:opriori!padding(15)Dan-ainNaneC3)Routerf* ~(6)DamainNam&server(255)End報(bào)丈奘型：ackDMP.8H翳堆址IPW祖IW閆ipie址子銅碼路■田I尸-DNSftSDHCPInform客戶端確認(rèn)信息DHCP客戶端如果需要從DHCP服務(wù)器端獲取更為詳細(xì)的配置信息，則發(fā)送Inform報(bào)文向服務(wù)器進(jìn)行請(qǐng)求，服務(wù)器收到該報(bào)文后，將根據(jù)租約進(jìn)行查找，找到相應(yīng)的配置信息后，發(fā)送ACK報(bào)文回應(yīng)DHCP客戶端。＜極少用到〉2750.2fl；759|l^.3.3.1022750.2fl；759|l^.3.3.10227S3.m21Hr3.3.1022761.289920.0.0.0『昌r-pfdri-『nii俱ef、件藥5J巧，鮎気F55255,255.255.2S5255-255.255.255rrrri-i~-teri-Tti-rDHCPDfrKP劑2xp :Enforml - iranswerIon id 0-x49f6d51ji劑2D*KP Inform - Transactian I& &x4^6d51-4346DHCP Request - Transaction ID 0x9296205fQUserDatagramPraracol?SrcParrQUserDatagramPraracol?SrcParr：!凸白聽(tīng)?wèi)鯀[〔丘?〕?0眈P口尸“c(50:7b:9d^00:1b:0c),Ost:Src^adcast〔ff汁fiff:ff汁f:ff)IBB.1.3.102(IBB.3.3.102),Dsr：|255-255.255.255(255.25i.255.255)Franie：舁；342bytes口口w~i「e：(2了越 342bytescaptured(273首bits)oninterface00Eth-ernetII.5rc:5Ch7b:陽(yáng)：0。：ib:(田IrrccrnetPro-tqcdIVersion4,Src::曰bodlstrappraTocalMessagelyue:bootRequesr.(1)Hardwaretype;Ethernet(0x01)Hardwar已a(bǔ)ddress1engthi；伍H叩呂：0Transaci:1orID:OK49f6d514Secondselapsed：!0田日巴oupfldig百：cijccicicidfuni匸匕門即]IPailcl『空5：[關(guān)門.LICIT〔1$良2?M1CCYaur(client)TPaddress:0.0,0,0CO-r0.0,0)DHCPRequest客戶端續(xù)租報(bào)文DHCP客戶端成功獲取IP地址后，在地址使用租期過(guò)去1/2時(shí)，會(huì)向DHCP服務(wù)器發(fā)送單播Request報(bào)文續(xù)延租期，如果沒(méi)有收到DHCPACK報(bào)文，在租期過(guò)去3/4時(shí)，發(fā)送廣播Request報(bào)文續(xù)延租期。

勺些2丁El?工￡■呂專2 ClClip255.255.255.255DHCP346DtKPRequest-TTari5act:ion100xg296ZO5f|602764.366S40.0.0.0^55.255.255.255DHCP346DHCPRequest-Trans-actiionIDOJi3e5dZJfO612767,?27340,0,0,0255-255-355-255DHCP346DHCPRequest-Transa匚iSonID口小記討的622776.5S5100,0,0,0255-255.255.255DHCP346WCPRequest-TTansacfianIDOni3e5d34fORFrame59:3>4tibytesonwire(2768bits),346bytesc-aptured￡2768bits)oninterface0QEthierinetIIPSrc:50:7b:3d:0031b:0c(5Q;7bj9d:00:lbsOc)HDsr:Bro-adcasr(ff:ff3ff:ff:ff::ff)l±ImerrietPrarQCDllVereiDn4,￡rc：D.Q.a.0(0.D.D-D)?DST!25^.255.255.255(255.255-255.255)田userDatagramprotocol,srcFort:booip-c(68)PD5inori^booips(>67)SBootstrapProtocolDHCPRelease客戶端釋放IP地址當(dāng)用戶不再需要使用分配IP地址時(shí)，就會(huì)主動(dòng)向DHCP服務(wù)器發(fā)送Release報(bào)文，告知服務(wù)器用戶不再需要分配IP地址，DHCP服務(wù)器會(huì)釋放被綁定的租約。557SD7：EU5TI60,ITT2S13.B45250?0.O.Q'2814.16112IBB.3u3.1D255,155.255,255DHCPDHCPLHrKZP255?255.255.255JL68u3.3.102557SD7：EU5TI60,ITT2S13.B45250?0.O.Q'2814.16112IBB.3u3.1D255,155.255,255DHCPDHCPLHrKZP255?255.255.255JL68u3.3.10234?dhcpRelease|-Transacrionid&M§ccaSc38342DHCPDiscover-TransactionID0x2a75if653342DhCPOffer -