The Client wants to discover a DHCP server that can provide services to it through this packet. (1) The client sends a broadcast packet using the IP address 0.0.0.0, and you can see that the destination IP is 255.255.255.255. These 4 data packets represent the interaction process between the client and the DHCP server, and are also the process of IP dynamic allocation. The following focuses on analyzing the 4 DHCP data packets generated by the ipconfig/renew command when executed. If ipconfig/renew is used again, 2 new packets will be added every time it is executed: DHCP Request DHCP ACk. You can see that 3 new packets have been added to Wireshark: DHCP ACK DHCP Request DHCP ACk. (4) For subsequent analysis and use, we will execute ipconfig/renew again: (3) Enter ipconfig/renew in cmd to request network connection.Īt this point, you can see that 4 new DHCP packets have been added to Wireshark:Īfter waiting for the execution of this command, you can see in cmd that the host is assigned an IP, and the host is successfully connected to the network. The Ethernet is disconnected.Ī DHCP Release packet was intercepted in Wireshark. You can see that all network cards have been disconnected at this time. (2) Enter ipconfig/release in cmd to disconnect the network connection. (1) Click start in Wireshark to start packet capture, and enter bootp in the filter bar to make it only display DHCP packets. After this command ends, the host will obtain an available IP and access the network again.Įxperiment environment: Win10, Wireshark 1.12.9, wired connection Updates the adapter information and requests to connect to the network. In cmd, you can use ipconfig/? to view the meaning of each parameter:ĭisconnects the current network connection, and the host IP becomes 0.0.0.0, the host is disconnected from the network and cannot access the network. Ipconfig/renew request to connect to the network Ipconfig/release disconnect the current network connection of the host Use the command ipconfig under cmd to complete the process of network disconnection and connection: If the host is connected to the Internet before the packet is captured, you need to disconnect the host's network connection and then connect to the network.

If you want to capture DHCP packets, you must first ensure that there is an available DHCP server, and then set the host IP address acquisition mode to be automatically acquired. Step 4: The DHCP Server sends an ACK packet to confirm the information.

Step 3: After the Client receives the Offer packet, it sends a DHCP Request packet to request IP allocation. Step 2: After the available DHCP Server receives the Discover packet, it gives the client a response by sending a DHCP Offer packet, which is intended to tell the client that it can provide an IP address. The realization of DHCP The realization ofĭHCP is divided into 4 steps, namely: theįirst step: the client initiates a DHCP Discover packet in the local area network, the purpose is to find the DHCP Server that can provide IP to it. As you can see later, when using Wireshark to filter and display DHCP packets, you need to enter the filter condition BOOTP instead of DHCP, but maybe because the Wireshark version I use is the older 1.12.9, I haven't tried it in the new version, maybe Enter DHCP to display only DHCP packets.Ģ. DHCP is more complex and more powerful than BOOTP. BOOTP was created to automatically assign addresses to devices connected to the network. The predecessor of DHCP is BOOTP (Bootstrap Protocol). When we set the client host ip address to be dynamically obtained, the DHCP server will assign an IP to the client according to the DHCP protocol, so that the client can use this IP to access the Internet. Dynamic Host Configuration Protocol DHCPĭHCP DHCP (Dynamic Host Configuration Protocol), dynamic host configuration protocol, is an application layer protocol. ĭHCP, DNS and HTTP are three common high-level protocols.ġ. Copyright statement: welcome to reprint, reprint to indicate the source.

Wireshark capture filter dhcp offer