We've finally arrived at our UDP DHCP session analysis.
Now you may be thinking to yourself, I don't know if I can go
through another crazy long session analysis,
Aaron. But don't worry, as our UDP session analysis is
drastically smaller than its TCP brother.
Even though UDP is less involved than TCP,
there are some topics that I want to make you aware of.
Remember, UDP is a best effort protocol,
and thus, there are no flags like SYN/ACK and FIN, but it does utilize options,
which can be similar in appearance to the flags,
especially when using DHCP. DHCP, as previously mentioned,
utilizes hard‑coded ports.
A computer requesting a DHCP address will use the port of 68 while
the responding server will utilize the port of 67.
Well, we finally covered enough prerequisite information.
So let's dive into our analysis of our DHCP UDP packet. As you can see,
we'll only be analyzing four sessions for our DHCP request.
I told you it was smaller. During session 1, we can see the
source PC utilizing the MAC address ending in 0014. It's
broadcasting to every node in the network,
utilizing the broadcast address of 255.255.255.255.
We should also take note of the source port of 68
and the destination port of 67.
We can also see the total length of the session is 310 bytes in size.
Let's parse this session down further by looking into a few of
the options in the DHCP portion of the session.
Notice how Option: (53) is set to Discover, and the requested address is
192.168.56.102. Even though UDP doesn't utilize flags,
this would be the most similar in action in comparison.
During session 2,
we can see the server with the source IP of 56.100 has sent a DHCP
address offering in response to session 1's request.
Notice how this source port has now changed to 67, and
the destination port has changed to 68.
It should also be noted that our length is increased to 556 bytes.
If we navigate to the DHCP subsection, we can also see what's been offered.
Within this sub section,
we can see that the client bearing the MAC address of 0014 has
been offered the address of 192.168.56.102, and we know that
this is an offer due to Option: (53).
Now, for fun,
let's expand the lease time just to see how long our address
lease will be good for. It looks like our DHCP lease time
will be good for about 20 minutes.
That's a little fast for most networks, as most
networks use an 8‑hour lease time, but this definitely won't harm anything.
At session 3,
we can see our source PC with a MAC address of 0014 is using the Request
Option: (53) to obtain the address of 56.102. Option: (50) from the
server of 56.100 is also utilizing Option: (54).
During our last session,
we can see the server of 56.100 has acknowledged the address request,
utilizing Option: (53). From within this session, we can verify that the
correct client has received the requested address due to the client's MAC
address of 0014 remaining the same throughout the request.
We can also see that the client's address is now 56.102.
Now, let's verify our DHCP request by looking at the lease
address listed in our router.
Great. As we can see, the IP of 192.168.56.102 has been given to the MAC address ending in 0014 with a 20‑minute lease time.