DHCP PROCESS Summary

Why do we need to know the DHCP lease Process? Because you are sitting in MCSE class, or you will try to go another job and someone in the interview, just like me will ask you the process. Perhaps you are doing troubleshooting why client is not getting IP address from DHCP server and you forgot to see the ports 67 and 68 was blocked. In any case knowing your stuff is going to make you smart and stronger. I recommend keep memorizing below simple process just in case if you ever been any of the situations I have speculated.

In TCP/IP little world a device cannot communicate to any other device unless it has an IP address. Now think about, XP client who has not have any IP address yet, able to locate the DHCP server and ask for an IP address. IN logic world you should say, hey wait a second how come client even can talk to DHCP server, client does not have any IP Address yet. ???????. If you wonder about the answer keep reading.

• At the time of the lease request, the client doesn't know what its IP address is, nor does it know the IP address of the server. To work around this, below how client is able to talk to a DHCP server
  
• Client uses 0.0.0.0 as its address and assumes 255.255.255.255 for the server's address.
  
• DHCP discover message on UDP port 68 and destination port 67.
  
• The discover message contains the hardware MAC address and NetBIOS name of the client.
  
• Once the first discover message is sent, the client waits 1 second for an offer. If no DHCP server responds within that time, the client repeats its request four more times at 2-, 4-, 8-, and 16 second intervals, if the client still doesn't get a response, it will revert to Automatic Private IP Addressing (APIPA) and Continue to broadcast discover messages every 5 minutes until it gets an answer. With APIPA, (169.254.X.Y) The Windows client will automatically pick what it thinks is an unused address.
  

DHCP lease is 4 way Process as listed below.

• DHCP – discovery (The discover message contains the hardware MAC address and NetBIOS name of the client.)
  
• DHCP - Lease offer
  
• DHCP - lease request
  
• DHCP- Lease acknowledgment
  

To keep memorize the process use simple map below

• DD ( DHCP Discovery)
  
• LO (Lease Offer)
  
• LR (Lease Request)
  
• LA (Lease Acknowledgment)
  

If this is not helping. Keep memorize the first one (- :

Discovering DHCP

Oz ozugurlu,
Systems Engineer
MCITP (EMA), MCITP (SA),
MCSE 2003 M+ S+ MCDST
Security Project+ Server+
oz@SMTp25.org
http://smtp25.blogspot.com

Subnetting Class C Network in a Nut Shell

Here is the exercise I have promised to my students. This is a fun part subletting and this question is very basic or I would say simple. The idea is to learn or understand the basic behind this question. Why do we need subletting seem to be a command question for many of my students, the answer is , would you b e more comfortable if you have to go to work and sit within the room with 50 people? Or would you prefer sitting in a office by yourself if you have to go to work every day. Obvious, answer will be, you want to sit by yourself in a dedicated office for many reasons. The reasons follow as

1. Security ( you don't want others figured out what web sites you are browsing on the internet , and trying to blog about exchange 2007 or Active Directory, or participating MSExchange.org forums, while you are on your company payroll (-J )
   
2. Less or none destructions by others, since you don't see and won't hear from them, when you shut your office door. This will give you a speed and you will be able to answer a lot of question posted on MSExchang.org
   
3. Since you have dedicated office if at the end of the year, MSExchange.org sends you a nice XMAS basket, less change a jealous colic would steal your beautiful XMAS basket. I mean you are easy to be located by others because your office has a number called (MAC address) on it.
   

Please answer the following questions

1. What is the full subnet mask?
   
2. How many Networks
   
3. How many hosts in each network
   
4. What is the IP Address of the each network?
   
5. What is the Default gateway of each network?
   
6. What is the Broadcast IP for each network?
   
7. What is the Broadcast IP for each network?
   
8. What is the IP address of PC2 and PC3?
   
9. What is the Subnet mask for PC2 and PC3?
   
10. What is the DGW IP for PC2 and PC3?
    
11. What is the IP address of PC4 and PC5
    
12. What is the Subnet mask for PC4 and PC5?
    
13. What is the DGW IP for PC4 and PC5?
    

    
    

As you see from above examples there are many advantages subletting. Don't forget IP Address is 32 Bits Binary number. Subnet mask is 32 bits binary number as well. The primary function of IP address is to provide communication in TCP/IP world we live in. The primary function of SM (Subnet mask) is to divide 32 bit complicated binary number IP Address into two distinct parts,

• Network
  
• Host
  

If two hosts belong to same network they can talk happily each other without needing to go through a router. However if two hosts are in two different network they must go through a router in order to talk. At least this is the basic to understand the purpose of Subnetting

The IP address of 0.0.0.0 is used for the default network.

What is an IP address?
IP address is a network layer protocol address for a host in a TCP/IP network. Or IP Address is 32 is 32 Bits binary number.

What are the components of an IP address?

An IP address consists of the following components:

• Network ID
  
• Host ID
  

For Instance, IP address 10.10.10.100 \24 subnet mask would produce as following results

• Network ID 10.10.10
  
• Host ID 100
  

What is a network ID?

A network ID uniquely identifies a network. All the hosts in a single network will have the same network ID. For example, in the IP address, the network ID is 10.10.10 A router analyses only the network ID portion of an IP address for datagram forwarding.

What is a host ID?

A host ID uniquely identifies a host in a network. Two hosts in two different networks can have the same host ID.

Example, in the IP address 10.10.10.100 host ID 100

What is a broadcast IP address?

The datagram with a broadcast IP address is received and processed by all the hosts in the local network. For example, the IP addresses 255.255.255.255, 10.10.10.255, 10.10.255.255, 10.255.255.255 are broadcast IP addresses.

What are the different classes of IP addresses?

• Class A
  
• Class B
  
• Class C
  
• Class D
  
• Class E
  

IP Address Class	Maximum number Networks	Max Num Hosts In each Network
Class A	126 (2^7 - 2)	16.777.214 (2^24 - 2)
Class B	16.384 (2^14)	65.534 (2^16 - 2)
Class C	20.971.52 (2^21)	254 (2^8 - 2)
Class D	-	-
Class E	-	-

What kind of networks use a Class A or Class B or Class C IP address typically?
Class A IP address is used for a network with large number of hosts. Class C IP address is used for a network with less number of hosts. Class B IP address is used for a network with medium number of hosts

What is the use of Class D IP addresses?
The Class D IP addresses are used for multicasting.

What is the use of Class E IP addresses?
The Class E IP addresses are reserved for experimental purpose

Oz ozugurlu,
Systems Engineer
MCITP (EMA), MCITP (SA),
MCSE 2003 M+ S+ MCDST
Security Project+ Server+
oz@SMTp25.org
http://smtp25.blogspot.com

Best practices for installing domain controller and deciding the disk configurations

What are the best practices for installing domain controller and deciding the disk configurations? This is one of the most asked questions. I recently participated, deciding the base line recommendations for an enterprise network, and prepare some documentation. I am sharing my findings here with you, and hoping you can find some useful information for your environment out of this article.

Let's see what Microsoft is recommending for sizing disk for domain controllers,

Component	Operations Performed	RAID System
Operating system files	Read and write operations	RAID 1
Active Directory log files	Mostly write operations	RAID 1
Active Directory database and SYSVOL shared folder	Mostly read operations	RAID 1 or RAID 0+1

Note:

• If cost is a factor in planning for disk space, you can place the operating system and Active Directory database on one RAID array (such as RAID 0+1) and the Active Directory log files on another RAID array (such as RAID 1). However, it is recommended that you store the Active Directory database and the SYSVOL shared folder on the same drive.
  
• To prevent single disk failures, many organizations use a redundant array of independent disks (RAID). For domain controllers that are accessed by fewer than 1,000 users, all four components generally can be located on a single RAID 1 array. For domain controllers that are accessed by more than 1,000 users, place the log files on one RAID array and keep the SYSVOL shared folder and the database together on a separate RAID array
  

Realistically this would be the best configuration. However many of the companies will consider budged and the most many administrators will get out from hardware configuration will be (4 Disks)

Component	OS	Operations Performed	RAID System	Disk Configuration
Operating System	Win 03 Win 08	Read and write	RAID 1	2 DISK ( 36GIG SCSCI) 10.000 or 15.000 RPM DRIVE C:\ (OS)
AD Logs		Mostly write	RAID 1	2 DISK ( 36GIG SCSCI) 10.000 or 15.000 RPM Drive L (logs) 18 GIG Drive D (Database .DIT and Sysvol)
.DIT database and SYSVOL		Mostly read	RAID 1 or RAID 0+1

If you have given one disk, I recommend at least, creating a partition and installing OS by itself and still separating .DIT and sysvol together and logs by itself to simulate the best practices. I hate to see .DIT database installed on C drive, this is just wrong for me by default , because I religiously believe, leave the OS by itself, by itself at least creating a partition ( if you have 1 DISK) or two (RAID 1), still make it look clean and organized, rather than having flat structure. Based on knowing OS generates Read and write operations on the I/O, and Logs as always write operations, and .DIT and sysvol will generate mostly read operations should make you to implement fastest write and read configurations with some hardware redundancy.

Opening a door for 64Bit architecture and taking advantage from fastest CPU, Motherboard and optimal memory will be the winning factor in my eyes. Of course after implementation the best configuration maintain and monitor AD heath is the secret to have healthy environment. I have been witnessing spending million $$$$$ for the infrastructure and not even thinking to bother to monitor the AD .DIT database is the most common mistake in large and medium businesses. I always been so sock and get used to see it within last 10 years. Pollution AD database and replication will eventually degrade the entire IT infrastructure and manager will always be looking for mistakes somewhere else rather than themselves.

What can we do, life isn't just perfect. I will continue to write some more about best practices soon

KB

Oz ozugurlu,
Systems Engineer
MCITP (EMA), MCITP (SA),
MCSE 2003 M+ S+ MCDST
Security Project+ Server+
oz@SMTp25.org
http://smtp25.blogspot.com

ACTIVE DIRECTORY DIAGNOSTIG LOG IN

We are familiar with diagnostic login in exchange. What happens if we need same type of capability for Active Directory? As you may know there is no place in the event log where diagnostic login can be turned on for AD related troubleshooting scenarios, such as troubleshooting KCC issues. The KCC (Knowledge consistency Checker) is a Microsoft Windows 2000 and Microsoft Windows Server 2003 component that automatically generates and maintains the intra-site and inter-site replication topology.

The KCC runs at regular intervals to adjust the replication topology for changes that occur in Active Directory, such as adding new domain controllers and new sites that are created. At the same time, the KCC reviews the replication status of existing connections to determine if any connections are not working. If a connection is not working, after a threshold is reached, KCC automatically builds temporary connections to other replication partners (if available) to insure that replication is not blocked.

On each domain controller, the KCC creates replication routes by creating one-way inbound connection objects that define connections from other domain controllers. For domain controllers in the same site, the KCC creates connection objects automatically without administrative intervention. When you have more than one site, you configure site links between sites and a single KCC in each site automatically creates connections between sites as well.if we want to make sure the KCC is completing successfully this would be one of the ways of doing it

Dcdiag /v /test: kccevent /s: nhqdtcdc4

(note: Nhqdtcdc4 is the name of my domain controller)

Testing server: JPK\NHQDTCDC4 Starting test: Connectivity * Active Directory LDAP Services Check * Active Directory RPC Services Check ......................... NHQDTCDC4 passed test Connectivity oing primary tests Testing server: JPK\NHQDTCDC4 Test omitted by user request: Replications Test omitted by user request: Topology Test omitted by user request: CutoffServers Test omitted by user request: NCSecDesc Test omitted by user request: NetLogons Test omitted by user request: Advertising Test omitted by user request: KnowsOfRoleHolders Test omitted by user request: RidManager Test omitted by user request: MachineAccount Test omitted by user request: Services Test omitted by user request: OutboundSecureChannels Test omitted by user request: ObjectsReplicated Test omitted by user request: frssysvol Test omitted by user request: frsevent Starting test: kccevent * The KCC Event log test Found no KCC errors in Directory Service Event log in the last 15 minutes. ......................... NHQDTCDC4 passed test kccevent Test omitted by user request: systemlog Test omitted by user request: VerifyReplicas Test omitted by user request: VerifyReferences Test omitted by user request: VerifyEnterpriseReferences Test omitted by user request: CheckSecurityError Running partition tests on : DomainDnsZones

If you are still having trouble with KCC what to do next? The next step is going to be turn on the diagnostic login for KCC. If you are thinking you have never seen this in event log, yes you are right, it would be nice if Microsoft included this into even log MMC, but we are not there yet (-:

Open regedit

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\ Diagnostics

• double-click on the diagnostics logging entry
  
• enter a number (05) based on how much you want logged
  

KKC should run every 15 minutes by default. The numbers are from 1 to 5 , 1 being minimum 3 being medium and 5 being maximum diagnostic login.

Here are the diagnostic logging settings for windows 2003

• Knowledge Consistency Checker
  
• Security Events
  
• ExDS Interface Events
  
• MAPI Interface Events
  
• Garbage Collection
  
• Internal Configuration
  
• Directory Access
  
• Internal Processing
  
• Performance Counters
  
• Initialization/Termination
  
• Service Control
  
• Name Resolution
  
• Backup
  
• Field Engineering
  
• LDAP Interface Events
  
• Setup
  
• Global Catalog
  
• Inter-site Messaging
  
• Group Caching
  
• Linked-Value Replication
  
• DS RPC Client
  
• DS RPC Server
  
• DS Schema
  
• Replication Events
  

Oz ozugurlu,
Systems Engineer
MCITP (EMA), MCITP (SA),
MCSE 2003 M+ S+ MCDST
Security Project+ Server+
oz@SMTp25.org
http://smtp25.blogspot.com