Table of Contents for
Packet Analysis with Wireshark

Version ebook / Retour

Cover image for bash Cookbook, 2nd Edition Packet Analysis with Wireshark by Anish Nath Published by Packt Publishing, 2015
  1. Cover
  2. Table of Contents
  3. Packet Analysis with Wireshark
  4. Packet Analysis with Wireshark
  5. Credits
  6. About the Author
  7. About the Reviewers
  8. www.PacktPub.com
  9. Preface
  10. What you need for this book
  11. Who this book is for
  12. Conventions
  13. Reader feedback
  14. Customer support
  15. 1. Packet Analyzers
  16. Introducing Wireshark
  17. Other packet analyzer tools
  18. Summary
  19. 2. Capturing Packets
  20. Troubleshooting
  21. Wireshark user interface
  22. Wireshark features
  23. Tcpdump and snoop
  24. References
  25. Summary
  26. 3. Analyzing the TCP Network
  27. TCP connection establishment and clearing
  28. TCP data communication
  29. TCP close sequence
  30. Lab exercise
  31. TCP troubleshooting
  32. TCP latency issues
  33. Wireshark TCP sequence analysis
  34. References
  35. Summary
  36. 4. Analyzing SSL/TLS
  37. The SSL/TLS handshake
  38. Key exchange
  39. Decrypting SSL/TLS
  40. Debugging issues
  41. Summary
  42. 5. Analyzing Application Layer Protocols
  43. BOOTP/DHCP
  44. DNS
  45. HTTP
  46. References
  47. Summary
  48. 6. WLAN Capturing
  49. Analyzing the Wi-Fi networks
  50. Wi-Fi sniffing products
  51. Summary
  52. 7. Security Analysis
  53. The DOS attack
  54. Scanning
  55. ARP duplicate IP detection
  56. DrDoS
  57. BitTorrent
  58. Wireshark protocol hierarchy
  59. Summary
  60. Index

BOOTP/DHCP

DHCP is an extension of the BOOTP mechanism. In other words, DHCP uses BOOTP as its transport protocol. This behavior allows existing BOOTP clients to interoperate with DHCP servers without requiring any change to the clients' initialization software; the following table shows basic comparisons between these two protocols:

BOOTP/DHCP

BOOTP

DHCP (Dynamic Host Configuration Protocol)

Meaning

Bootstrap Protocol

Dynamic Host Configuration Protocol extension of BOOTP

Year

1985

1993

UDP Server Port

67

UDP Client port

68

Services
  • IPv4 address assignment
  • Obtaining IPv4 configuration parameter
  • Limited number of client configuration parameters called vendor extensions
  • IP address assignment
  • Leases
  • Support legacy BOOTP functionality
  • DHCP supports a larger and extensible set of client configuration parameters called options

RFC

RFC951

RFC 2131

Existence

Superseded by the Dynamic Host Configuration Protocol (DHCP)

ACTIVE; RFCs keep coming to add more features and support different technical requirements

BOOTP/DHCP Wireshark filter

Use the bootp filter to display BOOTP/DHCP traffic and use UDP port 67 to capture the BOOT/DHCP traffic only.

Address assignment

DISCOVER, OFFER, REQUEST, ACK protocol exchanges happen between clients and servers during network address assignment, as shown in the following screenshot. As a mnemonic, refer to this as DORA.

The address assignment can also be done using the Rapid Commit option for DHCPv4. Modeled on DHCPv6, it uses two-message exchanges to quickly configure the DHCPv4 client.

Address assignment

To demonstrate four-message exchange open the DHCPv4.pcap file in the Wireshark, as shown in the following screenshot:

Address assignment

The preceding figure shows a message exchange happening between the DHCPv4 client and DHCPv4 server. This is summarized as follows:

  • DISCOVER (bootp.option.dhcp == 1):
    • Expand Bootstrap protocol to view BOOTP details
    • The client broadcasts (255.255.255.255), a DHCPDISCOVER message, on its local physical subnet and may include the option: (55 that is bootp.option.type) parameter request list; during this time the "yiaddr" field will be (bootp.ip.your == 0.0.0.0)
  • OFFER (bootp.option.dhcp == 2):
    • Expand Bootstrap protocol to view BOOTP details
    • The DHCP server may respond with a DHCPOFFER message that includes an available network address in the "yiaddr" (bootp.ip.your == 10.0.0.106) field
    • The DHCP server will send its option 54: DHCP server identifier and may include the other configuration parameter as requested in option 55 the DICOVER phase
  • DHCPREQUEST (bootp.option.dhcp == 3):
    • Expand Bootstrap protocol to view BOOTP details
    • The client broadcasts (255.255.255.255) a DHCPREQUEST message that must include the option 54 DHCP server identifier to indicate which server it has selected, and may include other options specifying the desired configuration values
    • The DHCP server selected in the DHCPREQUEST message commits the binding for the client to the db storage and responds with an ACK
  • ACK (bootp.option.dhcp == 5):
    • Expand Bootstrap protocol to view BOOTP details
    • The server will send the ACK to the client with the configuration parameter; during this time the IPv4 address will be "yiaddr" (bootp.ip.your == 10.0.0.106)
    • The client will verify the obtained configuration and check the IPv4 address again using the ARP protocol; if the address is in use by other dhcp clients, the client will send a DECLINE message to the server and restart the configuration process

Capture DHCPv4 traffic

The commands to capture DHCPv4 traffic are as follows:

  • On a Windows machine:
    1. Start a Wireshark capture.
    2. Open the Command Prompt.
    3. Type ipconfig /renew and press Enter.
    4. Type ipconfig /release and press Enter.
    5. Stop the Wireshark capture.
  • On a Linux machine:
    1. Start a Wireshark capture.
    2. Open the Command Prompt.
    3. Bring down the network interface:
      bash# ifdown eth0:0
    4. Bring up the network interface:
      bash$ ifup eth0:0
    5. Stop the Wireshark capture.
  • Using dhclient:
    1. Start a Wireshark capture.
    2. Open the Command Prompt.
    3. To capture a DORA packet use:
      bash$dhclient -4 eth0
    4. Stop the capture.