In this segment, we're going to look at
reviewing DORA and DHCP in general.
So, why is this important?
Well, DHCP, dynamic host configuration protocol,
is a commonly used way
for your clients to be dynamically assigned
IP addresses and, and other information such as
DNS servers settings, if you're still using WINS,
in any name, shape or form, it will provide that.
It can provide a gateway information.
It provides the basic IP information needed
for a client to participate on a network.
And why Wireshark can help you with this is
that there are problems with this in times, and
understanding DORA which is the actual
process the packets take, which we'll take a look at
in Wireshark, to have a client ask for,
excuse me, ask for and receive an IP address.
So, there's other factors involved.
There's lease times, there's a, you know,
the fact that it's broadcast-based and
you may have it crossing a router
and if you don't have an IP helper address
configured on your router, it may not work.
So, there's a lot of reasons why
it's important to understand what DHCP is,
understand the DORA concept and
what it will do for you.
So, in sum, DHCP, used to dynamically
configure host on your network.
It's the, it's the defacto standard.
It's an option of BOOTP
and it functions in a way where if you set up a
a DHCP server on your network,
clients will request IP addresses from it
and if it's configured correctly with the correct information,
will assign those, that IP information to that client
and allow it to participate on your network.
So, what is DORA?
DORA is the packets that go back and forth
from the client to the server in the process of
giving it that information.
So, you have discovery packet, an offer,
a request and an acknowledgement packet.
And you can use Wireshark
to capture DHCP from client to source to
destination server, the DHCP server
to troubleshoot connectivity issues.
So, what could some of those be?
Well, as you could see on the diagram,
there's a couple of things that can happen here.
For one, as you can see on the diagram,
the client is on a segment and it's asking for
an IP address and it needs to traverse a router.
Now, routers by default will not pass this information
so in order to do so, you will need to
configure a relay, which is called the DHCP relay agent,
relay agent, and that is known in the Cisco world as
an IP helper address.
And it will point it directly to the correct
DHCP server that will then send the packet back
and be able to give it to the client so that
it can get it's dynamically assigned information.
So, that being said, if we look at the actual capture,
we can see quite simply that we have a discover packet.
We have an offer packet, a request packet,
and acknowledgement packet.
So, what essentially is happening here is
the source does not have an IP address at all,
and it's requesting an IP address.
So, the client address is all zeroes and it's asking
the DHCP server from the source port,
bootp 68 to the destination of 67.
It's asking - I don't have any IP address information,
I am going to all apps broadcast out and try to figure out
if there is a DHCP server out there for me to participate with.
It will respond back with an offer,
ok, and you can see down here, the specific options.
And then, a request packet back
for the IP and then the actual acknowledgement.
And through this process, you can see here
that if there was something problematic within it,
for example, if you had an issue where
you did not have the router configured with the relay agent,
if you were doing a capture on both ends,
you could quickly find that you did not have
this set up and it was, the packet was never getting
to the DHCP server across the segment.
So, that is one simple way
to find if you have a communication issue.
And the communications review would be,
if the DHCP client sends the request,
broadcasts on the network
and the DHCP server responds
then you did not, you either had the relay agent
configured or it was local and wasn't passing the router.
You would see that on the local segment
or you would have to look inside the router
to see if you had an IP helper address configured,
you can go on either side of the router and
run the capture and if you're on the other side of the router,
where the DHCP server was living,
and you did not see discovery packets,
then it's quite possible, or you do not see the request
for the DHCP server to send the information back,
it's quite possible that it is misconfigured on the router.
So, remember communications review -
the client will make a request for an IP via broadcast.
The DHCP server on a local segment will reply back,
if it's on a separate segment.
The router will need to participate.
It will need to act as a relay agent.
Remember that routers do not do this by default.
They will have to be configured and
you can watch DORA discover, offer,
request and acknowlegement,
each step so that you can check
the capture to see if in fact, this did work.
And the relay agents is used to pass the broadcast,
facilitate the communication,
facilitate DORA from the client to the server and back
by bridging the communication
and allowing it to communicate from client
to the server by providing an IP helper address
and or DHCP relay agent.
And as a review,
you could check your discovery packet,
your offer, your request and your acknowledgement
to check in to see exactly where it's sourcing from,
what the destination is, if it's responding.
If you're only seeing discovery packets,
and you're not getting offers then
obviously, there's a break in the communication.
And or if you're looking at the DHCP server side
and you're not seeing a request from a specific address,
then it's likely it's not passing that traffic.