Wireshark 101: The Dynamic Host Configuration Protocol; HakTip 128 Video Lecture | Start Using Wireshark: Do Hacking like a Pro - Back-End Programming

this episode of hack tip is brought to
you by HipChat plus welcome to hack tip
the show where we break down concepts
tools and techniques for hackers gurus
and IT ninjas I'm Shannon Morse and
today we are checking out Wireshark and
DHCP so first off DHCP stands for
dynamic host configuration protocol and
it's a common upper-layer protocol
specifically we're looking at layer
seven way up at the top the application
layer DHCP makes it super easy for
devices to get an IP address
automatically DHCP s goal is to assign
addresses to clients during this thing
called a renewal process now there's a
bunch of info inside of a DHCP packet so
I'll go ahead and break it down for you
so you can you can see exactly what it
looks like inside of Wireshark so first
stop pulling up this middle window over
here we have bootstrap protocol I'll
explain that in just a bit as well as
what this discover means moving down a
little bit we have a whole bunch of
information down here so first off we
have what this message type is it'll say
boot request or you might have it say
reply then under there you'll have a
hardware type and this is gonna be
something like Ethernet in my case and
says Ethernet 0 X 0 1 so one Ethernet
the hardware length of the hardware
address the hops which are used to relay
agents to assist in finding a DHCP
server and then you have a transaction
ID which won't change between the
request for this transaction and the
response so both of those will be the
same then you have seconds elapsed which
shows you how long it's been since the
client first requested the address from
a DHCP server and down underneath that
we have all the different flags luckily
this one doesn't have that many flags
this is just going to show you what kind
of traffic this DHCP client can't accept
specifically now client IP address
that's you and then your IP address
which also becomes the client the server
IP address is going to be found right
below there and then you'll have a
gateway address as well if that's
included the client hardware address
which is going to be called the Mac of
course and you'll also have the server
hostname under that you'll include a
boot file name if there is one
available and any kind of options below
there and down at the bottom you have a
bunch of different options but I'm not
gonna go into those quite yet
now I'm gonna take a quick break but
we'll be right back after this sponsor I
would like to thank HipChat plus for
sponsoring this episode
HipChat plus allows you to do I am video
chat and document sharing screen sharing
system updates and even code sharing
integrated into one really simple
platform
I've been trying out HipChat plus here
in our office to send code snippets back
and forth do really quick video
conferences and all sorts other stuff
from one platform instead of like four
different ones HipChat
integrates into github which is super
cool bitbucket Zendesk
and tons of different companies as well
and it uses 256 bit ssl encryption for
everything you can get your team on the
same page in seconds I want you to try
HipChat plus free no credit card
required visit HipChat comm / hack tip
signup click on start chatting and
invite a few team members and try it for
free for 30 days remember that's HipChat
comm / hack tip and for the first 100
signups HipChat is going to extend their
30 day free trial to 90 days HipChat
your team your project in sync instantly
we're back with more fun stuff with DHCP
so first off I wanted to get back into
this thing called the renewal process
which I mentioned earlier now this has
four different parts and you can also
call this Dora for short I absolutely
love that name so this stands for four
different parts which you can actually
see up here in the info section this
includes discover offer request an ACK
for acknowledge you'll also notice that
each transaction ID up here is exactly
the same because all of these are
compiled together so the discover part
of this packet list is called that
because you as the client are trying to
discover a DHCP server by sending out a
really big pain to your entire network
you'll also notice at this stage that
you don't have an IP address so if I go
up to discover right here everything is
going to be listed as 0 0 0 0 your
discover packet will also say boot
request 1 in the message type area
address fields will all just say 0 0 0 0
and then there's a bunch of info in the
options area
now it says it's a DHCP discover packet
and then you have a client identifier
the requested IP address is going to be
a little bit below there and then a
parameter request which will list other
items that the client wants to know from
the DHCP server like the IP address of
other stuff on the network the next
packet that you're going to notice is
called offer so this is going to be the
second one in the entire list this offer
is from the DHCP server coming to the
clients so it's coming back at you it's
it's basically saying that it agreed
with your request or your discover now
it's as if the server is offering to
communicate and give the client an IP
address but how does it know how to fly
in the client if you don't have an IP
address yet well it's the hardware MAC
address so yeh ARP comes in handy now
this time the packet is a reply under
options you'll see that it's listed as a
DHCP offer now if I go down here to
options right here you'll see it listed
DHCP : offer and that's number 2 in the
list now this is going to have a subnet
mask a renewal time a rebinding time an
IP address least time I'll get back to
that in a second in an identifier for
this server now from here you will send
out a request packet back to the server
so this is the third one in our listing
by the way I got this entire really nice
spiel from over on the Wireshark site
they have a whole bunch of example
packet captures and this is one of them
so check it out if you have any
questions or if you want to follow along
really really handy so moving on with
that request packet this packet will
tell the server that the client approves
the info that has been offered up this
one still has zero zero zero zero as the
client IP address because you haven't
completed the entire acceptance package
yet and the options will still say DHCP
but in instead of saying offer it'll say
request now finally last stop we have
acknowledged or ACK for shirt you'll see
that all over the place whenever you
doing Wireshark packet captures now this
is sent from the server with the new IP
address for the client and then that new
IP address is finally recorded in its
database so if we take a look down here
you'll see that finally my clients IP
address has changed to be
one nineteen one six eight dot zero dot
ten yeah yeah I'm not a zero anymore I'm
so excited
no back when we mentioned that least
time thing this has to do with the
packet called an inn lease renewal now
when the client has used an IP address
for an allotted amount of time and must
tell the server that it wants an inn
lease renewal this is start a truncated
version of the Dora packets basically
you're not gonna have all the Dora
packets come through you just need to
renew that IP address with the server
again now lastly a note on DHCP options
as well you can find a listing of all of
these over at the IANA org website and I
actually have that website pulled up so
you can see exactly what it looks like
it's over at the boot P - DHCP -
parameters XHTML and this is going to
list out a whole bunch of good
information along with bootstrap
protocol parameters because by the way
bootstrap was used back in the day to
assign IPS to devices before a DHCP was
actually created to pretty much just
take its place now if you scroll down on
these options over on the iana website
you'll notice that there's about 15
different options available but it's
mainly eight of them that you might see
in Wireshark these are pretty
self-explanatory so I won't go into
details because obviously you'll see
ones like discover offer request and you
might even run into a decline now and
then you can always hit RFC 21:32 this
nice little link right there to read the
entire report on which each and every
one of these means now I think that
pretty much wraps up dhcp of course if
you guys have any questions or comments
you can let me know in the comments
below or you can email us tips at hack 5
org and be sure to check out our sister
show hack 5 for more great stuff just
like this I'll be there reminding you to
trust your techno Leste