dhcp报文分析

《dhcp报文分析》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。

1、DHCP报文分析一、在windows下对DHCP过程的抓包进步骤：1、首先打开wireshark进行抓2、在cmd中执行ipconfig/release，该命令的作用是用来释放1P，如果出现如下提示信息，表明本地连接没有设置成自动获取；p:DocunentsandSettingssdc>ipconfig/releasewindowsIPConfigurationTheoperationfailedasnoadapterisinthestatepermissibleforrt;bisoperation.在网络连接中将本地连接设成自动获取，再次执行ipconfig/relea

2、se:释放IP成功。Wircshark抓包如图::BootstrapProtocol(Release)Messagetype:BootRequest(1)Hardwaretype:Ethernet(0x01)Hardwareaddresslength:6Hops:0TransactsonID:OxlcOfc415tiSecondselapsed:0Bootpf1ags:0x0000(unicast)ClientIPaddress:192.168.75.235(192.168.75.235)Your(client)IPaddress:0.0.0.0(0.0.0.0)Nextse

3、rverIPaddress:0.0.0.0(0.0.0.0)RelayagentIPaddress:0.0.0.0(0.0.0.0)ClientMACaddress:Dell_99:25:7c(d4:be:d9:99:25:7c)Clienthardwareaddresspadding:00000000000000000000ServerhostnamenotgivenBootfilenamenotgivenMagiccookie:DHCPti+J+JtloptionOptionOptionOptionPadding(53)DHCPMessageType(Release)(5

4、4)DHCPServerIdentifier(61)ClientidentIf1er(255)End3、执行命令ipconfig/renew，发起一个DHCP过程，分析从这里开始。DocunentsandSettingszdc>ipconfig/renewindowsIPConfigurationEthernetadapterUMwareNetworkAdapterUMnet8:Connection-specificDNSSuffix.:IPAddress:172.16.18.1SubnetMask:255.255.255.0DefaultGateway:Ethernet

5、adapterUMwareNetworkAdapterUMnetl:Connection-specificDNSSuffix.:IPAddress:172.16.159.1SubnetMask:255.255.255.0DefaultGatevia:Ethernetadapter本地连接2:Connection-specificDNSSuffix.:IPAddress:192.168.75.235SubnetMask:255.255.255.0DefaultGateway:192.168.75.254DHCP通常有Discover、Offer、Request、Ack四个阶段，

6、wireshark抓包如下:448.753555000.0.0.0255.255.255.255DHCP342DHCPDiscover-TransactionID0x87380114458.75384200192.168.75.232255.255.255.255DHCP342DHCPOffer

7、TransactionID0x87380114468.754616000.0.0.0255.255.255.255DHCP357DHCPRequest-TransactionID0x87380114478.75489700192.168.75.232255.255.255.255DH

8、CP343DHCPACK-TransactionID0x87380114此外还有重新登陆和更新租约，这里不作解释。二、DHCP协议的报文格式如下，括号内为长度:OP⑴Htype(1)Hlen(l)Hops(1)TransactionID(4)Seconds⑵Flags(2)Ciaddr(4)Yiaddr(4)Siaddr(4)Giaddr(4)Chaddr(16)Snamc(64)File(128)Options(variable)下面结合在windows下对DHCP过程的抓进行分析：1、现在，客户机没