So let's have a look to see how a Dhcp mechanism works in detail.
Once a device is turned on and connected to a network that has a Dhcp server, it will send a request
to the server called a Dhcp discover request.
After the Discover packet reaches the Dhcp server, the server attempts to hold on to an IP address
that the device can use and then offers a client the address with a Dhcp offer packet.
Once the offer has been made for the chosen IP address, the device responds to the Dhcp server with
a Dhcp request packet to accept it.
After which the server sends an Ack packet that's used to confirm that the device has that specific
IP address and to define the amount of time that the device can use the address before getting a new
one.
If the server decides a device cannot have the IP address, it will send a Nak.
Let's see the Dhcp server mechanism in Wireshark.
So Wireshark is already embedded into Kali and it's ready to use.
In addition, I'd also like to show you how to download and install it in a Windows system.
So right now I'm in a Windows 8 system.
Open the internet browser and search for Wireshark for Windows using those as the keywords.
The first link is the download page of Wireshark.
Org.
So let's click it.
My windows is 64 bit, so I'll download the 64 bit, which is the latest stable version.
Click it and save the installer.
Now it takes less than a minute unless your connection is a mess.
You might want to look into that.
Just kidding.
Click to run it.
The setup Wizard opens.
Okay.
So simply it's a next.
Next.
Finish installation.
No need to change anything.
Wait until the installation finishes.
Okay, so check this to run Wireshark now and click Finish.
And welcome to the Wireshark and Windows interface.
So now I will show you the Dhcp mechanism in Wireshark.
So let's run Wireshark and you can see that it's listing the packets received by Eth0.
So to demonstrate the Dhcp mechanism.
We need to ask for an IP address over at the Dhcp server.
From the bottom right corner, right click to the network icon and select Open Network and Sharing Center.
Click Ethernet zero and then properties.
You'll have to scroll down a little bit and double click IP version four.
And as you see here, the IP address is manually set for my Windows 8.
So to start a Dhcp request, I'll choose obtain an IP address and DNS server address automatically.
Those are my options.
Now, before I click okay, I'll go to Wireshark and restart capturing by clicking the green button
on the toolbar.
So now Wireshark windows will be cleaned.
Continue without saving.
So now go to the network status window and click Okay.
And we can close all the networking windows.
So Wireshark captured the packets.
Well, it's still capturing, but let's go to the top of the list to find the Dhcp packets.
So here are the Dhcp.
Discover packet is right here at the top of the list.
When we look at the ports in the UDP header, we see that the port 68 is used to send Dhcp discover
packets.
So let's go back to the filter box and type UDP port equals equals 68 and now we have the Dhcp packets
only.
So the first packet is Dhcp Discover and as I mentioned before, it's broadcast source IP is all zeros
because we don't have an IP address at the moment.
Destination IP is all ones.
255.255 .255.255.
Because it's a broadcast packet.
And right here is bootstrap protocol, which is an application layer protocol used by Dhcp mechanisms.
The second packet is a Dhcp offer packet sent by the Dhcp server.
172.16.99.254 to the Windows system.
Destination IP is 172.16.99.233, which is offered to the Dhcp server.
So in here the destination Mac address is important.
That's what's going to be targeted according to the Mac address.
So as you see the destination Mac address of the Dhcp offer packet is the same as the source mac address
of the dhcp discover packet.
Now, the third packet is the Dhcp request sent by the window system.
It's still a broadcast packet and the source IP is still all zeros.
The message is request and the requested IP address is an option 50.
So if you expand it, you see the requested IP address and it's the same as the offered IP address.
172.16.99.223.
The last packet is Dhcp sent by the Dhcp server to the windows system.
This packet completes the Dhcp mechanism successfully.
So from now on, the IP address of our Windows system is.
172.16.99.223.