Discovering DHCP Discovery in SMTP25 Shell

Some of my readings and also knowledge made me put these notes together to see the DHCP process. To be honest the process explained below is in deep and should clear a lot of questions. In years I figured out being able to understand the process of DHCP is important. I have also included windows TCP/IP name resolution, which order it happens. Those of you who are familiar with host files and WINS might read the notes below.

DHCP Discovery

Discovering DHCP Discovery on Windows 2003 happens in four primary steps DHCP leas process is straight forward and 4 steps involves in it as below.

DHCP discovery

DHCP Lease offer

DHCP lease request

DHCP Lease acknowledgment

An IP address is required to communicate with other devices on a TCP/IP network, the DHCP negotiation happens very early in the Windows boot cycle. The Device without an IP address won't be able to talk to any other device within the TCP/IP network. So the process how client who has not yet have any IP address is described below in simple steps. At the time of the lease request, the client doesn't know what its IP address is, nor does it know the IP address of the server. To work around this, below how client is able to talk to a DHCP server

Client uses 0.0.0.0 as its address and

255.255.255.255 for the server's address.

Client who has not IP address will use 0.0.0.O ( all bits turned OFF)

And it uses 255.255.255.255 (All Bits Turned on), It then sends out a broadcast

!!! Commercial Break!!!!

Special thanks to Zack Payton , who will be remembered by me at all the times, a Man , good friend who is truly master of TCP/IP subletting, and making me understand the concept , Thanks ZACK (-: I still owe you a cold beer

DHCP discover message on UDP port 68 and destination port 67.

UDP User datagram Protocol, Connectionless Protocol, small fast efficient, not good for reliable communications

TCP Transmission Control protocol, Connection Oriented Protocol, Slow, but reliable protocol, it makes sure all TCP/IP packets gets there eventually, by resending packets if there is no acknowledgment The discover message contains the hardware MAC address and NetBIOS name of the client.

Once the first discover message is sent, the client waits 1 second for an offer. If no DHCP server responds within that time, the client repeats its request four more times at 2-, 4-, 8-, and

16-second (plus a random amount of time from 0 to 1000 milliseconds) intervals. If the client Still doesn't get a response, it will revert to Automatic Private IP Addressing (APIPA) and Continue to broadcast discover messages every 5 minutes until it gets an answer. With APIPA, The Windows client will automatically pick what it thinks is an unused address

169.254. X.Y (From the Address block) instead of waiting indefinitely for an answer (don't forget the Client will attempt to lease, or locate DHCP server

DHCP Lease Offer

The offer message is a proposal from the server to the client, and it contains an IP address,

• 
  
  A subnet mask,
  


• 
  
  A lease period (in days), and
  


• 
  
  The IP address of the DHCP server offering the proposal,
  
  The IP address being offered is temporarily reserved so that the server doesn't offer the same address to multiple Clients. All offers are sent directly to the requesting client's hardware MAC address.
  

DHCP Lease Selection

Once the client has received at least one offer, the third phase of the DHCP lease process begins. In this phase, the client machine will select an offer from those it received. Windows 2000, XP, and Server 2003 typically accept the first offer that arrives. (FCFS -First come first server)

To signal acceptance, the client broadcasts an acceptance message containing the IP address of the server it selected. It has to be broadcast so that the servers whose offers weren't selected can un-reserve (pull back) the Addresses they offered.

DHCP Lease Acknowledgment

Once the chosen DHCP server receives the acceptance message from the client, it marks the selected IP address as leased and sends an acknowledgment message, called a DHCPACK Back to the client. It's also possible that the server might send an negative acknowledgment, or

DHCPNACK to the client.

DHCPNACKs are most often generated when the client is attempting to renew a


Lease for its old IP address after that address has been reassigned elsewhere. Negative acceptance

Messages can also mean that the requesting client has an inaccurate IP address resulting from Physically changing locations to an alternate subnet.

The DHCPACK message includes any DHCP options specified by the server along with the IP address and subnet mask. When the client receives this message, it integrates the parameters into the TCP/IP stack, which can then proceed just as though the user had manually given it new configuration parameters.

This four-step process may seem overly complicated, but each step is necessary. The aggregate

result of these steps is that one server assigns one address to one client. For example, if each

server offering a lease immediately assigned an IP address to a requesting workstation, there

would soon be no numbers left to assign. Likewise, if the DHCP client controlled whether it

accepted or rejected the lease (instead of waiting for a DHCPACK or DHCPNACK message),

a slow client could cause the server to mark an assigned address as free and assign it somewhere

else—leaving two clients with the same offer.

DHCP Lease Renewal

What happens when the lease expires or needs to be renewed? No matter how long the lease period

is, the client will send a new lease request message to the DHCP server when the lease period is half over.

If the server hears the request message and there's no reason to reject it, it sends a DHCPACK to the client.

This will reset the lease period, just as signing a renewal rider on a car lease does. If the DHCP server isn't available, the client realizes that the lease can't be renewed. The client can then use the address for the rest of the lease period; once 87.5 percent of the lease period has elapsed, the client will send out another renewal request. At that point, any DHCP server that hears the renewal could respond to this DHCP request message, which is a request

For a lease renewal, with a DHCPACK and renew the lease. Any time the client gets a DHCPNACK message; it must stop using its IP address immediately and start the leasing process over from the beginning by requesting a brand-new lease.

When a client initializes TCP/IP, it will always attempt to renew its old address. Just as with any other renewal, if the client

Has time left on the lease, it will continue to use the lease until its end. If the client is unable to get a new lease by that time, all TCP/IP functions will stop until a new, valid address can be obtained.

Best Regards

Oz