themactep.com

A home of miscellaneous projects by Paul Philippov.

Notes

How to inspect DHCP protocol messages

sudo tcpdump -i eth0 port 67 or port 68 -n -v

you should start seeing requests and responses:

01:18:42.115959 IP (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto UDP (17), length 342)
    0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 02:44:dd:22:59:2e, length 314, xid 0xa1747c40, Flags [none]
	  Client-Ethernet-Address 02:44:dd:22:59:2e
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message (53), length 1: Request
	    Requested-IP (50), length 4: 192.168.23.41
	    Server-ID (54), length 4: 192.168.23.1
	    MSZ (57), length 2: 576
	    Parameter-Request (55), length 9: 
	      Subnet-Mask (1), Default-Gateway (3), Domain-Name-Server (6), Hostname (12)
	      Domain-Name (15), BR (28), NTP (42), Unknown (119)
	      Unknown (160)
	    Hostname (12), length 18: "ing-wyze-cam3-592e"
	    Vendor-Class (60), length 12: "udhcp 1.37.0"
	    Client-ID (61), length 7: ether 02:44:dd:22:59:2e
01:16:03.864388 IP (tos 0x0, ttl 16, id 0, offset 0, flags [none], proto UDP (17), length 328)
    192.168.23.1.67 > 192.168.23.221.68: BOOTP/DHCP, Reply, length 300, xid 0x924cc476, Flags [none]
	  Client-IP 192.168.23.221
	  Your-IP 192.168.23.221
	  Server-IP 192.168.23.1
	  Client-Ethernet-Address b0:41:6f:17:83:d2
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message (53), length 1: ACK
	    Subnet-Mask (1), length 4: 255.255.255.0
	    Default-Gateway (3), length 4: 192.168.23.1
	    Domain-Name-Server (6), length 4: 192.168.23.53
	    NTP (42), length 4: 192.168.23.1
	    Lease-Time (51), length 4: 1800
	    Server-ID (54), length 4: 192.168.23.1