카테고리 없음

dhcp 패킷 분석

오늘도힘차게 2013. 2. 23. 11:25
728x90

DHCP:DISCOVER 의 request 패킷 구조. dhcp 서버가 응답이 있을때까지 보낸다. secs는 Sequence를 말하는 것으로 보임.

아래 예정에서는 secs 39에서 응답이 오기 시작함.

 

DISCOVER에서 자신의 MAC과 HN(호스트네임) 그리고 요청값을 보낸다. 이에 대한 응답은 DHCP:OFFER를 통해 받는데

이 패킷안에 client의 ip 및 dns, gateway, netmasks 정보가 담겨져 있다.

 

DCHP:REQUEST 형태로 SID,RQ를 채워서 보낸다. 이에 대한 응답으로 DHCP:ACK 형태로 응답하는데 최종적인 값을 포함하고 있다.

 

DHCP:DISCOVER와 DHCP:REQUEST는 클라이언트에서 발생되며

DCHP:OFFER와 DHCP:ACK는 DHCP 서버의 응답을  DHCP Relay (보통 게이트웨이) 서버가 클라이언트에게 전달하는 형태이다.

 

중요한 것은 cid 값과 client의 mac이 같아야 정상적으로 ip를 할당 받을 수 있다.

 

19:13:38.789810 (tos 0x10, ttl 16, length: 328) 0.0.0.0.68 > 255.255.255.255.67: [udp sum ok] BOOTP/DHCP, length: 300
        Request, xid:0x16c6e0b8
          Client Ethernet Address: 00:08:88:06:16:b4
          Vendor-rfc1048:
            DHCP:DISCOVER
            LT:84000
            CID:[type-48]30:3a:30:38:3a:38:38:3a:30:36:3a:31:36:3a:42:34
            HN:"ana-eth0"
            PR:SM+DN+DG+NS

 

 

19:13:40.786674 (tos 0x10, ttl 16, length: 328) 0.0.0.0.68 > 255.255.255.255.67: [udp sum ok] BOOTP/DHCP, length: 300
        Request, xid:0x16c6e0b8, secs:3
          Client Ethernet Address: 00:08:88:06:16:b4
          Vendor-rfc1048:
            DHCP:DISCOVER
            LT:84000
            CID:[type-48]30:3a:30:38:3a:38:38:3a:30:36:3a:31:36:3a:42:34
            HN:"ana-eth0"
            PR:SM+DN+DG+NS

 

19:13:43.786647 (tos 0x10, ttl 16, length: 328) 0.0.0.0.68 > 255.255.255.255.67: [udp sum ok] BOOTP/DHCP, length: 300
        Request, xid:0x16c6e0b8, secs:6
          Client Ethernet Address: 00:08:88:06:16:b4
          Vendor-rfc1048:
            DHCP:DISCOVER
            LT:84000
            CID:[type-48]30:3a:30:38:3a:38:38:3a:30:36:3a:31:36:3a:42:34
            HN:"ana-eth0"
            PR:SM+DN+DG+NS

 

19:13:49.786646 (tos 0x10, ttl 16, length: 328) 0.0.0.0.68 > 255.255.255.255.67: [udp sum ok] BOOTP/DHCP, length: 300
        Request, xid:0x16c6e0b8, secs:12
          Client Ethernet Address: 00:08:88:06:16:b4
          Vendor-rfc1048:
            DHCP:DISCOVER
            LT:84000
            CID:[type-48]30:3a:30:38:3a:38:38:3a:30:36:3a:31:36:3a:42:34
            HN:"ana-eth0"
            PR:SM+DN+DG+NS

 

19:13:58.786647 (tos 0x10, ttl 16, length: 328) 0.0.0.0.68 > 255.255.255.255.67: [udp sum ok] BOOTP/DHCP, length: 300
        Request, xid:0x16c6e0b8, secs:21
          Client Ethernet Address: 00:08:88:06:16:b4
          Vendor-rfc1048:
            DHCP:DISCOVER
            LT:84000
            CID:[type-48]30:3a:30:38:3a:38:38:3a:30:36:3a:31:36:3a:42:34
            HN:"ana-eth0"
            PR:SM+DN+DG+NS

 

19:14:16.916649 (tos 0x10, ttl 16, length: 328) 0.0.0.0.68 > 255.255.255.255.67: [udp sum ok] BOOTP/DHCP, length: 300
        Request, xid:0x16c6e0b8, secs:39
          Client Ethernet Address: 00:08:88:06:16:b4
          Vendor-rfc1048:
            DHCP:DISCOVER
            LT:84000
            CID:[type-48]30:3a:30:38:3a:38:38:3a:30:36:3a:31:36:3a:42:34
            HN:"ana-eth0"
            PR:SM+DN+DG+NS

 

 

19:14:16.929288 (tos 0x0, ttl 255, length: 328) 59.9.167.254.67 > 59.9.167.141.68: [udp sum ok] BOOTP/DHCP, length: 300
        Reply, xid:0x16c6e0b8
          Your IP: 59.9.167.141
          Server IP: 121.138.7.42
          Gateway IP: 59.9.167.254
          Client Ethernet Address: 00:08:88:06:16:b4
          Vendor-rfc1048:
            DHCP:OFFER
            SID:121.138.7.42
            SM:255.255.255.0
            DG:59.9.167.254
            NS:168.126.63.1,168.126.63.2
            DN:"kornet"
            LT:3600

 

19:14:18.949706 (tos 0x10, ttl 16, length: 328) 0.0.0.0.68 > 255.255.255.255.67: [udp sum ok] BOOTP/DHCP, length: 300
        Request, xid:0x16c6e0b8secs:39
          Client Ethernet Address: 00:08:88:06:16:b4
          Vendor-rfc1048:
            DHCP:REQUEST
            SID:121.138.7.42
            LT:84000
            RQ:59.9.167.141
            CID:[type-48]30:3a:30:38:3a:38:38:3a:30:36:3a:31:36:3a:42:34
            HN:"ana-eth0"
            PR:SM+DN+DG+NS

19:14:18.962274 (tos 0x0, ttl 255, length: 328) 59.9.167.254.67 > 59.9.167.141.68: [udp sum ok] BOOTP/DHCP, length: 300
        Reply, xid:0x16c6e0b8
          Your IP: 59.9.167.141
          Server IP: 121.138.7.42
          Gateway IP: 59.9.167.254
          Client Ethernet Address: 00:08:88:06:16:b4
          Vendor-rfc1048:
            DHCP:ACK
            SID:121.138.7.42
            SM:255.255.255.0
            DG:59.9.167.254
            NS:168.126.63.1,168.126.63.2
            DN:"kornet"
            LT:3600

728x90