Dynamic host Configuration Protocol, DHP, now it's a protocol used to provide automatic and central
management for the distribution of IP addresses within a network.
It's also used to configure the proper subnet mask, default gateway and DNS server information on the
device.
And most homes and small businesses, the router acts as a DHP server in large networks, a single computer
might act as a DHP server.
In short, the process goes like this, otherwise the client requests an IP address from a router,
the host.
After which, the host assigns an available IP address to allow the client to communicate on the network.
So let's look at some of the advantages of using DHP.
A computer or any other device that connects to a network, local or Internet, must be properly configured
to communicate on that network.
Makes sense since DCPI allows that configuration to happen automatically.
It's used in almost every device.
It connects to a network, including computers, switches, smartphones, gaming consoles, you name
it.
And because of this dynamic IP address assignment, there's less of a chance that two devices will have
the same IP address, which is very easy to run into when using manually assign static IP addresses.
Using DHP also makes a network much easier to manage from an administrative point of view, every device
on the network can get an IP address with nothing more than their default network settings, which is
set up to obtain and address automatically.
So that's easy.
Gives them nothing to call the helpdesk about.
The only other alternative is to manually assign addresses to each and every device on the network.
You're not getting paid enough to do that.
So because these devices can get an IP address automatically, they can move freely from one network
to another, given that they're all set up with DCPI and receive an IP address automatically, which
is super helpful with mobile devices.
Now, as a cyber security expert, you should know one more thing about the mechanism.
The first device, which applies to a DHC discovery request, decides the configuration of the client.
There is not any mechanism to authenticate the DHP server.
Similarly, a server tries to reply to all the requests, and again, there is no authentication mechanism
for the client who request an IP, you get it?
I think you do.
What if a hacker replies before the real DHP?
Or what if a client sends a lot of DHP Discovery requests by changing the Mac address each time?
So let's have a look to see how a mechanism works in detail.
Once a device is turned on and connected to a network that has a DHP server, it will send a request
to the server called a Discover request.
After the Discover packet reaches the DHP server, the server attempts to hold on to an IP address that
the device can use and then offers a client the address with a offer packet.
Once the offer has been made for the chosen IP address, the device responds to the server with a DHP
request packet to accept it.
After which the server sends an X packet that's used to confirm that the device has that specific IP
address and to define the amount of time that the device can use the address before getting a new one.
If the server decides a device cannot have the IP address, it will send Nacke.
Let's see the server mechanism and Wireshark.
So Wireshark is already embedded into collee and it's ready to use in addition, I'd also like to show
you how to download and install it in a window system.
So right now, I'm in a Windows eight system, open the Internet browser and search for Wireshark for
Windows using those as the keywords.
First link is the download page of Wireshark dot org.
So let's click it.
My windows is 64 bit, so I'll download the 64 bit, which is the latest stable version, click it and
say the installer.
Now it takes less than a minute, unless your connection is a mess, you might want to look into that.
Click to run it.
A setup wizard opens.
OK, so simply it's a next next next finish installation, don't need to change anything.
Wait until the installation finishes.
OK, so check this to run Wireshark now and click finish.
And welcome to the Wireshark and Windows interface.
So now I will show you the DHP mechanism in Wireshark.
So let's run Wireshark and you can see that it's listing the packets received by E0.
So to demonstrate the DHS mechanism.
We need to ask for an IP address over at the DHP server.
From the bottom right corner, right, click to the network icon and Select Open Network and sharing
center, click Ethernet zero and then properties you have scroll down a little bit and double click
IP version for.
And as you see here, the IP address is manually set for my Windows eight.
So to start a DHP request, I'll choose obtain an IP address and DNS server address automatically.
Those are my options.
Now, before I click, OK, I'll go to Wireshark and restart capturing by clicking the green button
on the toolbar.
So now Wireshark windows will be cleaned, continue without saving.
So now go to the network status window and click, OK, and we can close all the networking windows.
So Wireshark captured the packet's, well, it's still capturing, but let's go to the top of the list
to find the DHP package.
So here the Discover packet is right here at the top of the list, when we look at the ports in the
UDP header.
We see that the Port 68 is used to send the HP Discover packets.
So let's go back to the filter box and type UDP port equals equals 68.
And now we have the DHP packets only.
So the first packet is the HP Discover, and as I mentioned before, it broadcast source IP is all zeroes
because we don't have an IP address at the moment.
Destination IP is all one's.
255, 255, 255, 255, because it's a broadcast Bacquet.
And right here is bootstrap protocol, which is an application layer protocol used by DHP mechanisms.
The second packet is a DHP offer packet sent by the DHP server one seven two one six eight nine nine
to five four to the Windows system.
Destination IP is one seven two point one six nine nine nine two three three, which is offered to the
DHP server to hear the destination.
Mac address is important.
That's what's going to be targeted according to the Mac address.
As you see, the destination Mac address of the DHC offer packet is the same as the source Mac address
of the DHP Discover packet.
Now, the third package is the DHP request sent by the window system.
It's still a broadcast packet and a source IP is still all zeroes.
The message is request, and the requested IP address is an option 50, so if you expand it, you see
the requested IP address and it's the same as the offered IP address, one seven two one six nine nine
nine two two three.
The last packet is sent by the server to the window system.
This packet completes the DHP mechanism successfully.
So from now on, the IP address of our Windows system is one seven two one six eight nine nine two two
three.