DHCP explained

Table of Contents1. What Is DHCP?.................................................................................................2

2. Understanding the Origins of DHCP.................................................................3

3. DHCP Communications....................................................................................5

4. DHCP Lease Process.........................................................................................8

5. Implementing DHCP…………………………………………………………………………………………………………..9

6. Managing Scopes...........................................................................................10

Exclusion Ranges...........................................................................................11

Reservations..................................................................................................11

Deleting Entries.............................................................................................11

7. DHCP Database..............................................................................................12

8. DHCP and DNS………………………………………………………………………………………………………………..13

DNS dynamic update.....................................................................................13

Secure DNS dynamic updates........................................................................14

9. Dhcp relay agents……………………………………………………………………………………………………………14

How relay agents work…………………………………………………………………………………………………….15

Using a relay agent........................................................................................15

10. DHCP security issues………………………………………………………………………………………………...……16

Adding Security to DHCP................................................................................16

DHCP Authentication......................................................................................16

11. Troubleshooting............................................................................................17

Preventing DHCP problems............................................................................17

Troubleshooting DHCP Clients........................................................................17

1

Troubleshooting DHCP Servers......................................................................19

1. What Is DHCP? DHCP stands for ‘Dynamic Host Configuration Protocol’ and is a means for

networked computers to get their TCP/IP networking settings from a central server. DHCP simplifies the administrative management of IP address configuration by automating address configuration for network clients. The DHCP server automatically allocates IP addresses and related TCP/IP configuration settings to DHCP-enabled clients on the network.

FIG. 1 DHCP SERVER ASSIGNS IP ADDRESSES TO MULTIPLE CLIENTS.

Every device on a TCP/IP-based network must have a unique IP address in order to access the network and its resources. Without DHCP, IP configuration must be done manually for new computers, computers moving from one subnet to another, and computers removed from the network. By deploying DHCP in a network, this entire process is automated and centrally managed. The DHCP server maintains a pool of IP addresses and leases an address to any DHCP-enabled client when it logs on to the network. Because the IP addresses are dynamic (leased) rather than static (permanently assigned), addresses no longer in use are automatically returned to the pool for reallocation. All DHCP traffic is encapsulated in UDP, and flows between port 68 (client) and port 67 (server).1

Most modern operating system includes DHCP in their primary settings, these includes windows OS, Novell NetWare, Sun Solaris, Linux and Mac OS. The clients’ requests for addressing configuration from a DHCP network server, the network server manages the assignment of IP addresses and must be obliged to answer to any IP configuration requests from clients.

1 http://technet.microsoft.com/en-us/library/cc958947.aspx

2

However, network routers, switches and servers need to have a static IP addresses, DHCP is not intended for the configuration of these types of hosts. Most administrators prefer to work with Network server that offers DHCP services. These types of network are scalable and easy to manage.2

There are two versions of DHCP, one for IPv4 and one for IPv6. While both versions bear the same name and perform much the same purpose, the details of the protocol for IPv4 and IPv6 are sufficiently different that they can be considered separate protocols. In this article we explain the DHCP for IPv4 protocol and its packets.3 The standards for this protocol are since 1997 described in the RFC 2131 reference.

FIG. 2 DHCP SERVER AUTOMATICALLY ALLOCATES IP ADDRESSES. 4

2. Understanding the Origins of DHCP The roots of DHCP began in the days when it was common to use

diskless workstations—that is, computers with no disk drives—on local area networks for economic reasons. To use a diskless workstation on a TCP/IP network, the computer still had to have a unique IP address, so a group of developers created a protocol called the Reverse Address Resolution Protocol (RARP) to make IP address assignment possible. RARP is standardized in a Request For Comments (RFC) document, published by the Internet Engineering Task Force (IETF), called RFC 903. It is closely related to the Address Resolution Protocol (ARP) still used on TCP/IP networks today. The difference between the two is that with RARP, a computer transmits a message containing its data-link layer hardware address to a server and receives in reply a message containing an IP address for it to use. ARP, by contrast, is used to resolve IP addresses into hardware addresses.

A RARP server uses the same message format as ARP and is a simple mechanism for assigning IP addresses over the network. RARP is insufficient for the configuration of a modern TCP/IP client, however, for several reasons. Chief

2 http://www.orbit-computer-solutions.com/DHCP.php3 http://www.art0.org/networking/the-dhcp-protocol-for-ipv4-explained4 http://www.tech-faq.com/dhcp.html

3

among these is that RARP assigns a workstation an IP address only; it cannot assign a subnet mask or other TCP/IP configuration parameters. Also, an administrator must configure a RARP server with the individual IP address assignments, so it provides no help in tracking address assignments.

The next step in the development of an automated TCP/IP configuration solution is called the Bootstrap Protocol (BOOTP). BOOTP offers several improvements over RARP, including the ability to supply clients with subnet masks, router addresses, and other TCP/IP configuration parameters in addition to IP addresses. Diskless workstations can also download an executable boot file from a BOOTP server using the Trivial File Transfer Protocol (TFTP).

FIG.3 RARP DOES ONLY ASSIGN AN IP-ADRESS. 5

The drawback of BOOTP, as with RARP, is that an administrator must create a configuration for each client on the BOOTP server. BOOTP therefore does nothing to prevent configuration errors such as duplicate or incorrect IP addresses.To address these shortcomings, a group of developers set out to define an improvement to BOOTP that would provide a complete, automated TCP/IP client configuration solution. The result was the Dynamic Host Configuration Protocol (DHCP), as defined in RFC 2131. The developers' design goals in creating DHCP included the following:

DHCP client computers should require no manual configuration. Each client should be able to discover appropriate local configuration parameters without user intervention and incorporate the parameters into its own configuration.

5 http://www.mylearningkit.com/difference-dhcp-with-bootp-and-rarp.html

4

DHCP clients should require no manual configuration. Under normal circumstances, the user or network administrator should not have to enter any per-client configuration parameters.DHCP should not require a server on each subnet. To allow for scalability and economy, DHCP must be able to function across routers or through the intervention of BOOTP relay agents.DHCP clients must be capable of handling multiple responses to a request for configuration parameters. This is to enable the installation of multiple, overlapping DHCP servers to provide fault tolerance and increase performance.DHCP must coexist with statically configured, nonparticipating hosts and with existing network protocol implementations.DHCP must be capable of providing service to existing BOOTP clients.DHCP must be able to ensure that any specific network address will not be in use by more than one DHCP client at a time.DHCP clients must retain their configurations across a DHCP client reboot. A DHCP client should, whenever possible, be assigned the same configuration parameters in response to each request.DHCP clients must retain their configuration across a DHCP server reboot. Whenever possible, a DHCP client should be assigned the same configuration parameters despite restarts of the DHCP server mechanism.DHCP must support fixed or permanent allocation of configuration parameters to specific clients.

The resulting DHCP mechanism is a combination of a client/server application and a protocol that performs two basic tasks: IP address assignment and configuration of other TCP/IP client parameters.6

3. DHCP CommunicationsActivating a DHCP client causes it to initiate communications with DHCP

servers whenever the computer starts. The client generates a series of DHCP packets using the DHCPDISCOVER message type, which it transmits as broadcasts. The function of these messages is to locate DHCP servers and to request an IP address assignment from them. Broadcasts are the client's only option at this point because it has no IP address yet, and it is therefore said to be in the init state. Like all broadcasts, these transmissions are limited to the client's local network and, under normal conditions, reach only the DHCP servers located on that network. However, administrators can install a DHCP Relay Agent service on a computer on the LAN, which relays the DHCPDISCOVER messages to DHCP servers on other networks. This enables a single DHCP server to service clients on multiple LANs.

6 http://www.microsoft.com/mspress/books/sampchap/6371.aspx#106

5

When a DHCP server receives a DHCPDISCOVER message from a client, it generates a response using the DHCPOFFER message type, containing an IP address and whatever other DHCP options the server is configured to supply. How the server transmits the DHCPOFFER message to the client is determined by a variety of factors. Chief among these is the state of the "broadcast bit," which is included in the Flags field of the DHCPDISCOVER message. This bit indicates whether the server should transmit its responses as broadcasts or unicasts. In most cases, the server transmits the DHCPOFFER message as a broadcast, because the client still does not have an IP address that the server can use for a unicast transmission. If the broadcast bit is not enabled, however, the server can generate a unicast transmission, using the IP address it is offering (found in the Yiaddr field) and the data-link layer hardware address specified in the Chaddr field of the DHCPDISCOVER message.

FIG.4 STEPS IN COMMUNICATION IN AN IPV.4 ENVOIRMENT 7

When the server receives the DHCPDISCOVER message through a DHCP relay agent, the server sends the DHCPOFFER message as a unicast to the relay agent address specified in the Giaddr field, and the relay agent either broadcasts or unicasts it to the client, based on the same criteria. It is also possible for a DHCP client to request a specific IP address in its DHCPDISCOVER messages by including an address in the Ciaddr field. The server can then send its DHCPOFFER messages as unicasts directly to the client using that address.

The internal behavior of a server when it offers an IP address and other configuration parameters to a client is left up to the individual implementation. In some cases, the server checks that the address it intends to offer is not already in use by transmitting an Internet Control Message Protocol (ICMP) Echo Request message to that address and then waiting to make sure that no reply arrives. The

7 http://www.art0.org/networking/the-dhcp-protocol-for-ipv4-explained

6

server also might reserve the offered address until it receives a response from the client

Because the client broadcasts its DHCPDISCOVER messages, more than one server might receive them, and the client might therefore receive DHCPOFFER responses from multiple servers. After a specified period of time, the client stops its broadcasting and accepts one of the offered IP addresses. To signal its acceptance, the client generates a DHCPREQUEST message, which includes the address of the server from which it is accepting the offer in the Server Identifier option, along with the offered IP address in the Requested IP Address option. The client always transmits the DHCPREQUEST message as a broadcast, both because it is not yet configured to use the offered IP address and to inform the other DHCP servers that it is rejecting their offers.

If the client receives no DHCPOFFER message in response to a DHCPDISCOVER message, it times out and repeats the DHCPDISCOVER broadcast. If, after repeated DHCPDISCOVER broadcasts, the client receives no DHCPOFFER messages in response, the DHCP address assignment procedure is considered to have failed. In some cases, client computers are permitted no further TCP/IP communications except for repeated DHCPDISCOVER broadcasts at regular intervals. In other cases (as with most of the Windows operating systems), the client automatically assigns itself an IP address, which might or might not enable it to interact with other computers on the network.

On receipt of the DHCPREQUEST message, the server whose offer the client is accepting commits the offered IP address and other settings to its database using a combination of the client's hardware address and the offered IP address as a unique identifier for the assignment. This is known as the lease identification cookie. To conclude its part of the transaction, the server sends a DHCPACK message to the client, which contains the same offered IP address and other options as in the DHCPOFFER message. This acknowledges the server's completion of the address assignment process. If the server cannot complete the assignment (because it has already assigned the offered IP address to another system, for example), it transmits a DHCPNAK message to the client and the whole process begins again with DHCPDISCOVER broadcasts.

After receiving a DHCPACK message from the server, the client performs a final test by generating a series of ARP broadcasts to ensure that no other system on the network is using the assigned IP address. If the DHCP client receives no response to the ARP transmissions, it configures the TCP/IP client with the IP address and other settings obtained by the server and notes the length of the lease that the server has offered. At this point the client enters what is known as the bound state. If another computer on the network does respond to the ARP broadcasts, the client cannot use the offered IP address and transmits a DHCPDECLINE message to the server, nullifying the transaction. The client can then reissue a series of DHCPDISCOVER messages, restarting the whole process.8

A concrete situation:

8 http://www.microsoft.com/mspress/books/sampchap/6371.aspx

7

A client with MAC-address 00:11:11:11:11:11 and no IP address want to join the network.

A DHCP server with IP 2.2.0.1 and MAC-address 00:22:22:22:22:22.

packet Source Destination

1

DHCPDISCOVER

sent by client(broadcast)

IP = 0.0.0.0 (MAC=00:11:11:11:11:11)

IP = 255.255.255.255 (MAC=ff:ff:ff:ff:ff:ff)

The DHCP discover packet is a request that is broadcast by clients that want to join a network. The packet contains the client MAC address. Additionally, it contains a list of information the client would like to receive. This list may include: subnet mask, DNS server IP, domain name, NETBIOS server IP, etc.

2

DHCPOFFERsent by DHCP

server(unicast)

IP = 2.2.0.1 (MAC=00:22:22:22:22:22)

IP = 2.2.0.231 (MAC=00:11:11:11:11:11)

When a DHCP server receives an IP lease request from a client, it reserves an IP address for the client and extends an IP lease offer by sending a DHCPOFFER message to the client. The client may receive one or more DHCPOFFER messages from one or more DHCP servers. This message contains the client's MAC address, the IP address that the server is offering, the subnet mask, the lease duration, and the IP address of the DHCP server making the offer.

3

DHCPREQUEST

sent by client(broadcast)

IP = 0.0.0.0 (MAC=00:11:11:11:11:11)

IP = 255.255.255.255 (MAC=ff:ff:ff:ff:ff:ff)

A client may choose to accept one of the offered IP address by broadcasting a DHCP request packet. This message contains the IP the client wants to start using, and the IP of the DHCP server that offered the IP. The message is broadcast to the entire network; when other DHCP servers receive this message, they withdraw any offers that they might have made to the client and return the offered address to the pool of available addresses.

4

DHCPACKsent by DHCP

server(unicast)

IP = 2.2.0.1 (MAC=00:22:22:22:22:22)

IP = 2.2.0.231 (MAC=00:11:11:11:11:11)

When the DHCP server receives the DHCPREQUEST message from the client, the configuration process enters its final phase. The acknowledgement phase involves sending a DHCPACK packet to the client. This packet includes the lease duration and any other configuration information that the client might have requested. At this point, the IP configuration process is completed.

The protocol expects the DHCP client to configure its network interface with the negotiated parameters.

After this configuration protocol is completed the client can start using IP address 2.2.0.231. If the DHCPACK message contained information about the default gateway, then the client can also start browsing the Internet without further configuration.

8

4. DHCP Lease Process A DHCP-enabled client obtains a lease for an IP address from a DHCP

server. Before the lease expires, the DHCP server must renew the lease for the client or the client must obtain a new lease. Leases are retained in the DHCP server database approximately one day after expiration. This grace period protects a client's lease in case the client and server are in different time zones, their internal clocks are not synchronized, or the client is off the network when the lease expires.9

In windows, the ipconfig tool can be used to view the current IP lease, and force renewal of the lease.

Release the IPv4 address:

Request a new IPv4 address:

On most Linux distributions the ifconfig tool can be used to view the current IP lease.

9 http://technet.microsoft.com/en-us/library/cc958908.aspx

9

The DHCP client on Linux is called dhclient or dhclient3. To see if you are currently running the client

Use the -r switch to release your DHCP lease and terminate the client.

And restart it to negotiate a new lease. The dhclient program will stay in the foreground until it has obtained an IP, then fork into the background.

5. Implementing DHCPAlthough Windows DHCP clients naturally work well together with DHCP

servers, it is also possible for a Windows DHCP server to support clients running other operating systems and for Windows clients to function with other DHCP server implementations. You can therefore use the Windows DHCP servers for your entire network, even if you run various client operating systems.

When planning a DHCP implementation, you must consider a number of factors, including the following:

The number of clients you intend to support. A single DHCP server can theoretically support 1000 scopes with a total of 10,000 clients, depending on the other factors. However, most medium to large networks have at least two DHCP servers so that service can continue if one server fails. To provide fault tolerance, you should divide the range of IP addresses you plan to assign on each subnet between two DHCP servers in an 80/20 split. It is important to understand that DHCP servers do not work together; each server has its own range of addresses to assign. If you configure two DHCP servers with the same identical scope, they will attempt to assign the same IP addresses to clients.

10 http://www.art0.org/networking/the-dhcp-protocol-for-ipv4-explained#viewSource

10

The configuration of your internetwork. The number of networks that make up your internetwork and the technologies used to connect them can have a great effect on your DHCP implementation. The use of DHCP relay agents prevents you from having to install a DHCP server on every network segment. When branch offices are connected together using relatively slow wide area network (WAN) links, it is generally not a good idea to have DHCP clients that rely on servers at distant locations.

The performance capabilities of your servers. DHCP is a highly disk- intensive service. If you plan to have DHCP servers with heavy client loads, you should make sure that your server hardware is fast enough to avoid becoming a performance bottleneck. To ensure proper performance, you should plan your server hardware implementation around a worst-case DHCP traffic scenario, such as the end of a brief power outage in which all your client computers are attempting to contact the DHCP server at nearly the same time.

6. Managing Scopes A scope must be defined and activated before DHCP clients can use the

DHCP server for dynamic TCP/IP configuration. A DHCP scope is an administrative collection of IP addresses and TCP/IP configuration parameters that are available for lease to DHCP clients. The network administrator creates a scope for each logical or physical subnet.

A scope has the following properties:

A scope name, assigned when the scope is created.A range of possible IP addresses from which to include or exclude addresses used in DHCP lease offers.A unique subnet mask, which determines the subnet for a given IP address.Lease duration values.

Each subnet can have a single DHCP scope with a single continuous range of IP addresses. To use several address ranges within a single scope or subnet, you must first define the scope and then set exclusion ranges.

11

FIG.5 THE SCOPE NAME DIALOG BOX. 11

Exclusion Ranges When you create a new scope, addresses of existing statically configured computers should be immediately excluded from the range. By using exclusion ranges, an administrator can exclude IP address ranges within a scope so those addresses are not offered to clients.Excluded IP addresses can be active on your network, but only by manually configuring these addresses at computers that do not use DHCP to obtain an address. Exclusion ranges should be used for computers or devices that must have a static IP address, such as printer servers, firewalls, or routers.

Reservations An administrator can reserve IP addresses for permanent lease assignment to specified computers or devices on the network. Reservations ensure that a specified hardware device on a subnet can always use the same IP address. Reservations should be made for DHCP-enabled devices that must always have the same IP address on your network, such as print servers, firewalls, or routers. For more information, see "Managing Reservations" later in this chapter.

Deleting Entries There may be times when a scope needs to be modified in order to delete the lease of a DHCP client. The main reason for doing so is to remove a lease that conflicts with an IP address exclusion range or a reserved address that you want to specify. Deleting a lease has the same effect as if the client's lease expired—the next time the client system starts, it must go through the process of requesting a lease. There is nothing, however, to prevent the client from obtaining a new lease for the same IP address.To prevent this, you must make the address unavailable before the client can

11 http://www.microsoft.com/mspress/books/sampchap/6371.aspx

12

request another lease by removing it from the scope and setting a reservation or exclusion. Delete scope entries only for clients that are no longer using the assigned DHCP lease or that are to be moved immediately to a new address. Deleting an active client could result in duplicate IP addresses on the network because deleted addresses are automatically reassigned to new clients.After you delete a client's lease from the scope and set a reservation or exclusion, you should always run ipconfig /release at a command prompt on the client computer, to force the client to free its IP address with a DHCPRelease message.12

Fig.6 The IP Address Range page.13

7. DHCP Database The DHCP service database is a dynamic database that is updated as

DHCP clients are assigned or as they release their TCP/IP configuration parameters. There is no set limit to the number of records that a DHCP server can store. The size of the database is dependent upon the number of DHCP clients on the network. The DHCP database grows over time as a result of clients starting and stopping on the network.

The size of the DHCP database is not directly proportional to the number of active client lease entries. Over time, as some DHCP client entries become obsolete and are deleted, there remains some unused space.

12 http://technet.microsoft.com/en-us/library/cc958911.aspx13 The IP Address Range page

13

To recover the unused space, the DHCP database is compacted. Starting with Windows NT Server 4.0, dynamic database compaction occurs on DHCP servers as an automatic background process during idle time or after a database update.14

DHCP service database files

File Description

Dhcp.mdb The DHCP server database file.

Dhcp.tmp

A temporary file used by the DHCP database as a swap file during database index maintenance operations. This file

sometimes remains in the Systemroot\System32\Dhcp directory after a system failure.

J50.log and J50#####.lo

g

A log of all database transactions. This file is used by the DHCP database to recover data when necessary.

J50.chk A checkpoint file.

8. DHCP and DNSDNS servers provide name resolution for network clients. DNS resolves a

fully qualified domain name (FQDN) to its corresponding IP address.

Although DHCP provides a powerful mechanism for automatically configuring client IP addresses, in releases of the operating system before Windows 2000, the DHCP Server service did not notify DNS to update the DNS records on behalf of the client. Specifically, DHCP did not map the client name to an IP address and did not update IP address-to-name mappings using DNS dynamic update.

Without a way for DHCP to interact with DNS, the information maintained by DNS for a DHCP client might be incorrect. For example, a client can acquire its IP address from a DHCP server, but the DNS records might not reflect the IP address acquired nor provide a mapping from the new IP address to the FQDN.

DNS dynamic updateIn Windows Server 2003 and Windows Server 2008, DHCP servers and clients can register record updates if the DNS server supports DNS dynamic update. In

14 http://technet.microsoft.com/en-us/library/cc781140(WS.10).aspx

14

Windows Server 2003 and Windows Server 2008, the DNS service supports DNS dynamic update.

A DHCP server running Windows Server 2008 can register with a DNS server and update pointer (PTR) and address (A) resource records on behalf of its DHCP-enabled clients by using the DNS dynamic update protocol.

DHCP clients running Windows operating systems from Windows 2000 and later typically update their own dynamic forward lookup names, as shown in the following figure.

FIG. 7 DHCP CLIENT AND DHCP SERVER PERFORMING DNS DYNAMIC UPDATE.

Secure DNS dynamic updatesBy itself, DNS dynamic update is not secure; any client can modify DNS records. When secure DNS dynamic update is configured, the authoritative name server accepts updates only from clients and servers that are authorized to make DNS dynamic updates to the appropriate objects in AD DS. Secure DNS dynamic update is available only on Active Directory–integrated zones.

Secure DNS dynamic update allows you to specify the users and groups that can modify zones and resource records. By default, Windows clients running Windows 2000 and later attempt unsecured DNS dynamic updates first. If that request fails, they attempt secure updates.

When using multiple DHCP servers and secure DNS dynamic updates, add each of the DHCP servers as members of the DnsUpdateProxy global security group so that any DHCP server can perform a secure DNS dynamic update for any record. Otherwise, when a DHCP server performs a secure DNS dynamic update for a record, that DHCP server is the only computer that can update the record.15

9. DHCP relay agentsA DHCP relay agent is a hardware device or software program that can

pass DHCP or BOOTP messages between DHCP clients and servers. DHCP relay agents act as proxies, forwarding messages from a subnet to one or more DHCP

15 http://technet.microsoft.com/en-us/library/dd183657(WS.10).aspx

15

servers. Some DHCP messages are sent as broadcasts, so without relay agents and the ability to pass DHCP and BOOTP messages across routers, every subnet on a network must have its own DHCP server.

Most routers support acting as a DHCP relay agent. Alternatively, if a router cannot function as a DHCP relay agent, a computer that can function as a DHCP relay agent must be configured on each subnet to which the router is connected.

In cases where it is impractical or impossible to configure routers to act as a DHCP relay agent, you can configure a computer running Windows Server 2003 or Windows Server 2008, to act as a relay agent by enabling the Routing and Remote Access service and installing the DHCP Relay Agent routing protocol component.

How a relay agents workThe following figure shows how Client C on Subnet 2 obtains a DHCP address lease from DHCP Server 1 on Subnet 1.

FIG. 8 THE RELAY AGENT.

Using a relay agent1. DHCP Client C broadcasts a DHCPDiscover message on Subnet 2 as a UDP

datagram over well-known UDP port 67, which is the port reserved and shared for BOOTP and DHCP server communication.

2. The relay agent, in this case a DHCP relay-enabled router, examines the Gateway IP Address field (also known as the giaddr field) in the DHCP message header. If the field has an IP address of 0.0.0.0, the agent fills the Gateway IP Address field with the IP address assigned to the interface on which the DHCPDiscover was received, and forwards the DHCPDiscover message as a unicast message to the DHCP server on Subnet 1.

3. When DHCP Server 1 receives the DHCPDiscover message, it examines the Gateway IP Address field to determine if the packet was relayed. The DHCP server then determines whether it can supply an IP address lease to clients on the subnet indicated by the address in the Gateway IP Address field.For example, if the Gateway IP Address field has an IP address of 192.168.45.2, the DHCP server checks its DHCP scopes for a scope range that includes

16

192.168.45.2 (the gateway IP address in the packet). To find a match, the DHCP server determines whether the IP address 192.168.45.2 matches the network ID of each scope. It determines the network ID of each scope by ANDing any IP address in the scope with its corresponding subnet mask. In this case, the DHCP server checks to see which scope includes addresses for Subnet 2. If a scope exists that matches this criterion, the DHCP server selects an available address from the matched scope to use in an IP address lease offer response to the client.

4. DHCP Server 1 sends a DHCPOffer message directly to the relay agent identified in the Gateway IP Address field.

5. The relay agent relays the DHCPOffer message to the DHCP client.Depending on the value of the Broadcast flag in the DHCPOffer message (which was copied from the DHCPDiscover message), the DHCP relay agent either unicasts or broadcasts the DHCPOffer message.

6. By using a similar process, a DHCPRequest message is relayed from client to server, and a DHCPAck message is relayed from server to client.16

10. DHCP Security IssuesDHCP was designed in the early 1990s, when the number of organizations

on the Internet was relatively small. Furthermore, it was based on BOOTP, which was created in the 1980s when the Internet as we know it today barely even existed. In those days, Internet security wasn't a big issue, because it was mostly a small group of research and educational organizations using TCP/IP on the Internet. As a result, DHCP, like many protocols of that era, doesn't do much to address security concerns.

Actually, this is a bit understated. Not only does DHCP run over IP and UDP, which are inherently insecure, the DHCP protocol itself has in fact no security provisions whatsoever. This is a fairly serious issue in modern networks, because of the sheer power of DHCP: the protocol deals with critical configuration information. There are two different classes of potential security problems related to DHCP:

I. Unauthorized DHCP Servers If a malicious person plants a “rogue” DHCP server, it is possible that this device could respond to client requests and supply them with spurious configuration information. This could be used to make clients unusable on the network, or worse, set them up for further abuse later on. For example, a hacker could exploit a bogus DHCP server to direct a DHCP client to use a router under the hacker's control, rather than the one the client is supposed to use.

16 http://technet.microsoft.com/en-us/library/dd183657(WS.10).aspx

17

II. Unauthorized DHCP Clients A client could be set up that masquerades as a legitimate DHCP client and thereby obtain configuration information intended for that client; this could then be used to compromise the network later on. Alternately, a “bad guy” could use software to generate lots of bogus DHCP client requests to use up all the IP addresses in a DHCP server's pool. More simply, this could be used by a thief to steal an IP address from an organization for his own use.

Adding Security to DHCP These are obviously serious concerns. The normal recommended solutions to these risks generally involve providing security at lower layers. For example, one of the most important techniques for preventing unauthorized servers and clients is careful control over physical access to the network: layer one security. Security techniques implemented at layer two may also be of use, for example, in the case of wireless LANs. Since DHCP runs over UDP and IP, one could use IPSec at layer three to provide authentication.

DHCP Authentication To try to address some of the more specific security concerns within DHCP itself, in June 2001 the IETF published RFC 3118, Authentication for DHCP Messages. This standard describes an enhancement that replaces the normal DHCP messages with authenticated ones. Clients and servers check the authentication information and reject messages that come from invalid sources. The technology involves the use of a new DHCP option type, the Authentication option, and operating changes to several of the leasing processes to use this option.

Unfortunately, 2001 was pretty late in the DHCP game, and there are millions of DHCP clients and servers around that don't support this new standard. Both client and server must be programmed to use authentication for this method to have value. A DHCP server that supports authentication could use it for clients that support the feature and skip it for those that do not. However, the fact that this option is not universal means that it is not widely deployed, and most networks must rely on more conventional security measures.17

11. Troubleshooting

A.Preventing DHCP Problems Many DHCP problems involve incorrect or missing configuration details. To help prevent the most common types of problems, you should do the following:

Use the 80/20 design rule for balancing scope distribution of addresses where multiple DHCP servers are deployed to service the same scope.

17 http://www.tcpipguide.com/free/t_DHCPSecurityIssues.htm

18

Using more than one DHCP server on the same subnet provides increased fault tolerance for the DHCP clients located on that subnet. With two DHCP servers, if one server is unavailable, the other server can take its place and continue to lease new addresses or renew existing clients.Use server-side conflict detection on DHCP servers only when it is needed. Either DHCP servers or clients can use conflict detection to determine whether an IP address is already in use on the network before leasing or using the address.Create reservations on all DHCP servers that can potentially service the reserved client. You can use a reservation to ensure that a DHCP client computer always receives the same IP address. If a client using a reservation can conceivably contact more than one DHCP server during its startup, you should create an identical reservation for that client on each of the DHCP servers.For server performance, remember that DHCP is disk-intensive and purchase hardware with optimal disk performance characteristics. DHCP causes frequent and intensive activity on server hard disks. To provide the best performance, consider RAID 0 or RAID 5 solutions when purchasing hardware for your server computer.

B.Troubleshooting DHCP ClientsMost DHCP-related problems start as a failed IP configuration attempt at a client, so it is good practice to start there. After you have determined that a DHCP-related problem does not originate at the client, check the system event log and DHCP server audit logs for clues. When the DHCP service does not start, these logs generally explain the source of the service failure or shutdown. Further, you can use the Ipconfig.exe utility at the command prompt to get information about the configured TCP/IP parameters on the computer.

The following sections describe common symptoms of DHCP client problems. When a client fails to obtain a TCP/IP configuration, you can use this information to quickly identify the source of the problem.

Invalid IP Address Configuration If a DHCP client does not have an IP address configured or has an IP address configured as 169.254.x.x, that means that the client was not able to contact a DHCP server and obtain an IP address lease. This is either because of a network communications failure or because the DHCP server was unavailable. If this occurs, you should verify that the client computer has a valid, functioning network connection.

First, check that all the client's network-related hardware devices, such as the cables and network interface adapters, are installed and working properly. Next, check that all the necessary networking software components are installed in the client computer, including the network interface adapter driver, the Client for Microsoft Networks module, and the Internet Protocol (TCP/IP) module. In the

19

Internet Protocol (TCP/IP) Properties dialog box, make sure that Obtain An IP Address Automatically is selected.

One method for checking the networking capabilities of the client computer is to install the NetBIOS Enhanced User Interface (NetBEUI) protocol module. NetBEUI requires no configuration, so simply installing it should enable the computer to communicate with other NetBEUI clients on the network. If the computer can communicate over the network using NetBEUI, you know that the problem lies in the TCP/IP implementation or configuration. If the computer cannot communicate using NetBEUI (assuming that there are other NetBEUI systems on the LAN), you know that the problem lies elsewhere, such as in the network interface adapter, the other networking software components, or the network itself.

Missing Configuration Settings If a DHCP client is missing configuration settings, the client might be missing DHCP options in its leased configuration, either because the DHCP server is not configured to supply those options, or because the client does not support the options distributed by the server. If this problem occurs on Windows 2000 DHCP clients, verify that the most commonly used and supported options have been configured at either the server or scope level of option assignment. Windows 2000 DHCP Server includes support for numerous options that the Windows 2000 DHCP clients cannot use. These options are intended for DHCP clients running other operating systems. Check the DHCP option settings on the server and make sure that you have selected the appropriate options for your clients.

DHCP Servers Do Not Provide IP AddressesIf DHCP clients are able to access the network but are still unable to obtain IP addresses from a DHCP server, the problem has several possible causes. One cause might be a change in the IP address of the DHCP server. A DHCP server can only service requests for a scope that has a network identifier that is the same as the network identifier of its own IP address. Make sure that the DHCP server IP address falls in the same network range as the scope it is servicing. For example, a server with an IP address in the 192.168.0.0 network cannot assign addresses from scope 10.0.0.0 unless you use superscopes.

Another possible cause of the problem is that the DHCP clients are located on a different LAN from the DHCP server and must go through a router to obtain IP addresses. A DHCP server can provide IP addresses to client computers on other LANs only if a DHCP relay agent is available. Completing the following steps might correct this problem:

Configure a DHCP/BOOTP relay agent on the LAN where the clients are located. The relay agent can be on the router itself or on a Windows 2000 Server computer running the Routing and Remote Access Server service.At the DHCP server, configure a scope to match the network address on the other side of the router where the affected clients are located.

20

In the scope, make sure that the subnet mask is correct for the remote network.Do not include this scope (that is, the one for the remote network) in superscopes configured for use on the same local subnet or segment where the DHCP server resides.

Another possibility is that multiple DHCP servers exist on the same LAN. Make sure that you do not configure multiple DHCP servers on the same LAN with scopes that contain the same addresses. You might want to rule out the possibility that one of the DHCP servers in question is a computer running Microsoft Small Business Server. By design, the DHCP service in Small Business Server automatically stops when it detects another DHCP server on the LAN.18

C.Troubleshooting DHCP Servers When a DHCP server fails to provide leases to its clients, clients most often discover the failure in one of three ways:

The client might be configured to use an IP address not provided by the server.The server sends a negative response to the client, and the client displays an error message indicating that a DHCP server could not be found.The server leases an address to the client but the client appears to have other network configuration-based problems, such as the inability to register or resolve DNS or NetBIOS names or to access computers beyond its local network.

The first troubleshooting task is to make sure that the DHCP service is running. You can verify this by opening the DHCP console and attempting to access the server or by opening the Computer Management console and looking at the Services list under Services And Applications. If the DHCP Server service is not started, you can attempt to start it manually using the Start Service button in the console toolbar. However, be sure to take notice of the service's startup type. If the startup type is set to Manual, then it is quite possible that the server computer was restarted and no one started the DHCP Server service. If the startup type is automatic and the service is not running, however, there must be a reason. Either the service failed to start when the computer started, someone manually stopped the service, or it has halted of its own accord. Check the logs in Event Viewer to determine whether the server failed to start or stopped because of a problem elsewhere in the computer, such as a memory shortage.

DHCP Console Incorrectly Reports Lease ExpirationsWhen the DHCP console displays the lease expiration time for reserved clients for a scope, it indicates one of the following:

If the scope lease time is set to an infinite lease time, the reserved client's lease is also shown as infinite.

18 http://www.microsoft.com/mspress/books/sampchap/6371a.aspx

21

If the scope lease time is set to a finite length of time (such as 8 days), the reserved client's lease uses this same lease time.

The lease term of a DHCP reserved client is determined by the lease assigned to the reservation. To create reserved clients with unlimited lease durations, create a scope with an unlimited lease duration and add reservations to that scope.

DHCP Server Uses Broadcasts to Respond to All Client MessagesThe DHCP server uses broadcast transmissions to respond to all client configuration request messages, regardless of how each DHCP client has set the broadcast bit flag. DHCP clients can set the broadcast flag (the first bit in the 16-bit Flags field in the DHCP message header) when sending DHCPDISCOVER messages to indicate to the DHCP server that it should address its DHCPOFFER messages to the limited broadcast address (255.255.255.255).

By default, the DHCP server in Windows NT Server 3.51 and earlier versions ignored the broadcast flag in DHCPDISCOVER messages and sent all DHCPOFFER replies as broadcasts. This behavior is implemented on the server to avoid problems that can result from clients not being able to receive or process a unicast response without a complete TCP/IP configuration.

Starting with Windows NT Server 4, the DHCP service still attempts to transmit all DHCP responses to the limited broadcast address, unless support for unicast responses is explicitly enabled by setting the value of the IgnoreBroadcastFlag registry entry to 1. This registry entry is located in HKEY_LOCAL_MACHINE\System\ CurrentControlSet\Services\DHCPServer\Parameters\IgnoreBroadcastFlag. When set to 1, the computer ignores the broadcast flag in client requests and broadcasts all DHCPOFFER responses. When the registry entry is set to 0, the server adjusts its transmission behavior (whether to broadcast or not) based on the value of the broadcast bit flag in the client's DHCPDISCOVER request. If this flag is set in the request, the server transmits its responses to the limited local broadcast address. If the flag is not set in the request, the server transmits its responses directly to the client as unicasts.

DHCP Server Fails to Issue Address Leases for a New ScopeThere are situations in which you might want to assign new IP addresses to all the DHCP clients on a particular network. You might have obtained a registered class of IP addresses for your network, or you might be changing the address class to accommodate more computers or more networks. To do this, you create a new scope on your DHCP server containing a range of new addresses. In this type of situation, you want clients to obtain leases in the new scope instead of using the earlier scope to obtain or renew their leases. When all clients are actively obtaining leases in the new scope, you intend to remove the existing scope. However, when you activate the new scope, you find that the DHCP clients do not obtain leases from the newly defined scope.

When superscopes are not available or not used, only a single DHCP scope can be active on the network at one time. If more than one scope is defined and activated on the DHCP server, the server uses only one scope to provide leases

22

to clients. The active scope that the DHCP server used for distributing leases is determined by the network identifier in the first IP address assigned to the DHCP server's network interface adapter hardware. The DHCP server always uses the scope with the same network identifier as its own IP address. You can configure additional IP addresses for a network interface using the IP Settings tab in the Advanced TCP/IP Properties dialog box, but these addresses have no effect on the DHCP server's scope selection.

You can resolve this problem in the following ways:

Configure the DHCP server to use a superscope that includes the earlier scope and the new scope.Change the primary IP address—that is, the address assigned in the Internet Protocol (TCP/IP) Properties dialog box for the DHCP server's network adapter to an IP address that has the same network identifier as the new scope. If necessary, you can maintain the prior address that was first assigned as an active IP address for the server computer by moving it to the list of multiple IP addresses maintained in the Advanced TCP/IP Properties tab.19

19 http://www.microsoft.com/mspress/books/sampchap/6371a.aspx#164

23