Slide 1

Dynamic Host Configuration Protocol DHCP Slide 2 Dynamic Host Configuration Protocol -- DHCP -- Networking protocol Obtains configuration information for operation in an Internet Protocol network Used by network devices i.e. DHCP clients Can reduce system administration workload Allowing network to add devices with little or no manual intervention Can reduce the number of IP addresses required for a network Slide 3 Dynamic Host Configuration Protocol DHCP Specifications: RFC 1531 initially defined DHCP as a standard-track protocol October 1993 Succeeded the Bootstrap Protocol (BOOTP) RFC 2131 updated DHCP for Internet Protocol version 4 (IPv4) networks released in 1997 RFC 3315 defined the extensions of DHCP for IPv6 (DHCPv6) Slide 4 Technical overview DHCP automates network-parameter assignment to network devices From one or more DHCP servers DHCP makes it easy to add new machines to the network Even for small networks May reduce number of IP addresses required for an organization E.g. laptops that may be off site dont need an IP address Slide 5 Technical overview When a DHCP-configured client connects to a network: computer or any other network-aware device DHCP client sends a broadcast query requesting necessary information from a DHCP server DHCP server manages a pool of IP addresses and information about client configuration parameters such as default gateway, domain name, the DNS servers, other servers such as time servers, and so forth DHCP server assigns the requesting computer: an IP address a lease (length of time the allocation is valid) other IP configuration parameters, such as the subnet mask and the default gateway Query typically initiated immediately after booting Must complete before the client can initiate IP-based communication Slide 6 Technical overview Depending on implementation, the DHCP server may have three methods of allocating IP-addresses: dynamic allocation automatic allocation static allocation Slide 7 Technical overview Dynamic Allocation: Network administrator: Assigns a range of IP addresses available to DHCP Client computers on the LAN: IP software configured: Request an IP address from the DHCP server During network initialization Request-and-grant process uses a lease concept Has a controllable time period Allows the DHCP server to reclaim (and later reallocate) IP addresses that are not renewed Dynamic re-use of IP addresses Slide 8 Technical overview Automatic Allocation: DHCP server permanently assigns a free IP address to a requesting client from the range defined by the administrator Similar to dynamic allocation, except: DHCP server keeps a table of past IP address assignments Server can preferentially assign a client the same IP address that the client previously had Slide 9 Technical overview Static Allocation: DHCP server allocates an IP address based on a table Contains MAC address/IP address pairs Manually generated E.g. by a network administrator Only requesting clients with a MAC address listed in this table will be allocated an IP address This feature is variously called: Static DHCP Assignment (DD-WRT) Fixed-address (in the dhcpd documentation) DHCP reservation or Static DHCP (Cisco/Linksys and Tomato) IP reservation or MAC/IP binding (various other router manufacturers) Note: not all routers support static allocation Slide 10 Technical details DHCP uses two ports: 67/udp for the server side 68/udp for the client side same as the ports assigned by IANA for BOOTP DHCP operations fall into four basic phases: IP discovery IP lease offer IP request IP lease acknowledgment Slide 11 DHCP Discovery Client broadcasts messages on the physical subnet to discover available DHCP servers Network administrators can configure a local router to forward DHCP packets to a DHCP server on a different subnet This client-implementation creates a User Datagram Protocol (UDP) packet with the broadcast destination 255.255.255.255 or Specific subnet broadcast address Slide 12 DHCP Discovery A DHCP client can also request its last-known IP address If the client remains connected to a network for which this IP is valid, the server might grant the request Otherwise, it depends whether the server is set up as authoritative or not An authoritative server will deny the request forcing the client ask for a new IP immediately A non-authoritative server simply ignores the request Leads to an implementation-dependent timeout for the client to give up on the request and ask for a new IP address Slide 13 DHCP offer When a DHCP server receives an IP lease request from a client, it: Reserves an IP address for the client Extends an IP lease offer by sending a DHCPOFFER message to the client containing: the client's MAC address the IP address that the server is offering the subnet mask the lease duration the IP address of the DHCP server making the offer Server determines the configuration based on the client's hardware address as specified in the CHADDR (Client Hardware Address) field Here the server, 192.168.1.1, specifies the IP address in the YIADDR (Your IP Address) field Slide 14 DHCP request A client may receive DHCP offers from multiple servers Will only accept one DHCP offer Broadcast a DHCP request message for that offer Based on the Transaction ID field in the request Servers are informed whose offer the client has accepted When other DHCP servers receive this message Withdraw any offers that they might have made to the client Return the offered address to the pool of available addresses Slide 15 DHCP acknowledgment When the DHCP server receives the DHCPREQUEST message from the client Configuration processes enters its final phase Acknowledgement phase involves sending a DHCPACK packet to the client Packet includes lease duration any other configuration information that the client might have requested At this point, the IP configuration process is complete After the client obtains an IP address Client may use the Address Resolution Protocol (ARP) to prevent IP conflicts caused by overlapping address pools of DHCP servers Slide 16 DHCP information A DHCP client may request more information than the server sent with the original DHCPOFFER The client may also request repeat data for a particular application For example, browsers use DHCP Inform to obtain web proxy settings via WPAD Such queries do not cause the DHCP server to refresh the IP expiry time in its database Slide 17 DHCP releasing Client Sends a request to the DHCP server to release the DHCP information Deactivates its IP address Client devices usually do not know when users may disconnect from the network Protocol does not mandate the sending of DHCP Release Slide 18 Client configuration parameters DHCP server can provide optional configuration parameters to the client RFC 2132 describes the available DHCP options defined by Internet Assigned Numbers Authority (IANA) DHCP and BOOTP PARAMETERS DHCP client can select, manipulate and overwrite parameters provided by a DHCP server Slide 19 Options Option exists to identify vendor and functionality of a DHCP client Variable-length string of characters or octets Meaning specified by the vendor of the DHCP client Vendor Class Identifier (VCI) (Option 60). Method a DHCP client can utilize to communicate to the server that it is using a certain type of hardware or firmware is to set a value in its DHCP requests Allows DHCP server to differentiate between the two kinds of client machines e.g. process requests from two types of modems appropriately Some types of set-top boxes also set the VCI (Option 60) to inform the DHCP server about the hardware type and functionality of the device Gives the DHCP server a hint about any required extra information that this client needs in a DHCP response Slide 20 DHCP Relaying In small networks DHCP typically uses broadcasts In some circumstances, unicast addresses will be used For example: when networks have a single DHCP server that provides IP addresses for multiple subnets When a router for such a subnet receives a DHCP broadcast it converts it to unicast with a destination MAC/IP address of the configured DHCP server, source MAC/IP of the router itself GIADDR field of this modified request is populated with the IP address of the router interface on which it received the original DHCP request GIAADDR: Gateway address DHCP server uses the GIADDR field to identify the subnet of the originating device in order to select an IP address from the correct pool DHCP server then sends the DHCP OFFER back to the router via unicast Router converts the DHCP OFFER back to a broadcast, sent out on the interface of the original device Slide 21 Security DHCP protocol became a standard before network security became a significant issue: DHCP includes no security features Potentially vulnerable to two types of attacks: Unauthorized DHCP Servers: Since one cannot specify the server you want: oan unauthorized server can respond to client requests osending client network configuration values that are beneficial to the attacker As an example, a hacker can hijack the DHCP process to configure clients to use a malicious DNS server or router Unauthorized DHCP Clients: By masquerading as a legitimate client, an unauthorized client can gain access to network configuration and an IP address on a network it should otherwise not be allowed to use By flooding the DHCP server with requests for IP addresses oit is possible for an attacker to exhaust the pool of available IP addresses odisrupting normal network activity (a denial of service attack) Slide 22 Security RFC 3118 ("Authentication for DHCP Messages") introduced authentication information into DHCP messages Allows clients and servers to reject information from invalid sources Although support for this protocol is widespread: Large numbers of clients and servers still do not fully support authentication Forces servers to support clients that do not support this feature As a result, other security measures are usually implemented around the DHCP server (such as IPsec) Ensures that only authenticated clients and servers are granted access to the network Slide 23 Security Addresses should be dynamically linked to a secure DNS server Allows troubleshooting by name rather than by a potentially unknown address Effective DHCP-DNS linkage requires having a file of either MAC addresses or local names that will be sent to DNS that uniquely identifies physical hosts, IP addresses, and other parameters such as the default gateway, subnet mask, and IP addresses of DNS servers from a DHCP server DHCP server ensures that all IP addresses are unique i.e. no IP address are assigned to a second client while the first client's assignment is valid (its lease has not expired) IP address pool management is done by the server and not by a network administrator Slide 24 DHCP can: A. Reduce the number of IP addresses required in an organization B. Ease the installation of new computers C. Assign gateway addresses on clients D. All of the above E. None of the above 30 sec