Components of DHCP The main components of DHCP include: DHCP Server: DHCP Server is a server that holds IP Addresses and other information related to configuration. DHCP Client: It is a device that receives configuration information from the server. It can be a mobile, laptop, computer, or any other electronic device that requires a connection. DHCP Relay: DHCP relays basically work as a communication channel between DHCP Client and Server. IP Address Pool: It is the pool or container of IP Addresses possessed by the DHCP Server. It has a range of addresses that can be allocated to devices. Subnets: Subnets are smaller portions of the IP network partitioned to keep networks under control. Lease: It is simply the time that how long the information received from the server is valid, in case of expiration of the lease, the tenant must have to re-assign the lease. DNS Servers: DHCP servers can also provide DNS (Domain Name System) server information to DHCP clients, allowing them to resolve domain names to IP addresses. Default Gateway: DHCP servers can also provide information about the default gateway, which is the device that packets are sent to when the destination is outside the local network. Options: DHCP servers can provide additional configuration options to clients, such as the subnet mask, domain name, and time server information. Renewal: DHCP clients can request to renew their lease before it expires to ensure that they continue to have a valid IP address and configuration information. Failover: DHCP servers can be configured for failover, where two servers work together to provide redundancy and ensure that clients can always obtain an IP address and configuration information, even if one server goes down. Dynamic Updates: DHCP servers can also be configured to dynamically update DNS records with the IP address of DHCP clients, allowing for easier management of network resources. Audit Logging: DHCP servers can keep audit logs of all DHCP transactions, providing administrators with visibility into which devices are using which IP addresses and when leases are being assigned or renewed Working of DHCP DHCP works on the Application layer of the UDP Protocol. The main task of DHCP is to dynamically assigns IP Addresses to the Clients and allocate information on TCP/IP configuration to Clients. For more, you can refer to the Article Working of DHCP. The DHCP port number for the server is 67 and for the client is 68. It is a client-server protocol that uses UDP services. An IP address is assigned from a pool of addresses. In DHCP, the client and the server exchange mainly 4 DHCP messages in order to make a connection, also called the DORA process, but there are 8 DHCP messages in the process. The 8 DHCP Messages 1. DHCP Discover Message: This is the first message generated in the communication process between the server and the client. This message is generated by the Client host in order to discover if there is any DHCP server/servers are present in a network or not. This message is broadcasted to all devices present in a network to find the DHCP server. This message is 342 or 576 bytes long. As shown in the figure, the source MAC address (client PC) is 08002B2EAF2A, the destination MAC address(server) is FFFFFFFFFFFF, the source IP address is 0.0.0.0(because the PC has had no IP address till now) and the destination IP address is 255.255.255.255 (IP address used for broadcasting). As they discover message is broadcast to find out the DHCP server or servers in the network therefore broadcast IP address and MAC address is used. 2. DHCP Offers A Message: The server will respond to the host in this message specifying the unleased IP address and other TCP configuration information. This message is broadcasted by the server. The size of the message is 342 bytes. If there is more than one DHCP server present in the network then the client host will accept the first DHCP OFFER message it receives. Also, a server ID is specified in the packet in order to identify the server. 3. DHCP Request Message: When a client receives an offer message, it responds by broadcasting a DHCP request message. The client will produce a gratuitous ARP in order to find if there is any other host present in the network with the same IP address. If there is no reply from another host, then there is no host with the same TCP configuration in the network and the message is broadcasted to the server showing the acceptance of the IP address. A Client ID is also added to this message. Now, the request message is broadcast by the client PC therefore source IP address is 0.0.0.0(as the client has no IP right now) and destination IP address is 255.255.255.255 (the broadcast IP address) and the source MAC address is 08002B2EAF2A (PC MAC address) and destination MAC address is FFFFFFFFFFFF. Note – This message is broadcast after the ARP request broadcast by the PC to find out whether any other host is not using that offered IP. If there is no reply, then the client host broadcast the DHCP request message for the server showing the acceptance of the IP address and Other TCP/IP Configuration. 4. DHCP Acknowledgment Message: In response to the request message received, the server will make an entry with a specified client ID and bind the IP address offered with lease time. Now, the client will have the IP address provided by the server. Now the server will make an entry of the client host with the offered IP address and lease time. This IP address will not be provided by the server to any other host. The destination MAC address is 00:11:22:33:44:55 (client’s MAC address) and the destination IP address is 255.255.255.255 and the source IP address is 172.16.32.12 and the source MAC address is 00AA00123456 (server MAC address). 5. DHCP Negative Acknowledgment Message: Whenever a DHCP server receives a request for an IP address that is invalid according to the scopes that are configured, it sends a DHCP Nak message to the client. Eg-when the server has no IP address unused or the pool is empty, then this message is sent by the server to the client. 6. DHCP Decline: If the DHCP client determines the offered configuration parameters are different or invalid, it sends a DHCP decline message to the server. When there is a reply to the gratuitous ARP by any host to the client, the client sends a DHCP decline message to the server showing the offered IP address is already in use. 7. DHCP Release: A DHCP client sends a DHCP release packet to the server to release the IP address and cancel any remaining lease time. 8. DHCP Inform: If a client address has obtained an IP address manually then the client uses DHCP information to obtain other local configuration parameters, such as domain name. In reply to the DHCP inform message, the DHCP server generates a DHCP ack message with a local configuration suitable for the client without allocating a new IP address. This DHCP ack message is unicast to the client. Note – All the messages can be unicast also by the DHCP relay agent if the server is present in a different network Security Considerations for Using DHCP To make sure your DHCP servers are safe, consider these DHCP security issues: Limited IP Addresses : A DHCP server can only offer a set number of IP addresses. This means attackers could flood the server with requests, causing essential devices to lose their connection. Fake DHCP Servers : Attackers might set up fake DHCP servers to give out fake IP addresses to devices on your network. DNS Access : When users get an IP address from DHCP, they also get DNS server details. This could potentially allow them to access more data than they should. It’s important to restrict network access, use firewalls, and secure connections with VPNs to protect against this. Advantages Centralized management of IP addresses. Centralized and automatedTCP/IP configuration . Ease of adding new clients to a network. Reuse of IP addresses reduces the total number of IP addresses that are required. The efficient handling of IP address changes for clients that must be updated frequently, such as those for portable devices that move to different locations on a wireless network. Simple reconfiguration of the IP address space on the DHCP server without needing to reconfigure each client. The DHCP protocol gives the network administrator a method to configure the network from a centralized area. With the help of DHCP, easy handling of new users and the reuse of IP addresses can be achieved. Disadvantages IP conflict can occur. The problem with DHCP is that clients accept any server. Accordingly, when another server is in the vicinity, the client may connect with this server, and this server may possibly send invalid data to the client. The client is not able to access the network in absence of a DHCP Server. The name of the machine will not be changed in a case when a new IP Address is assigned. Which port is used in DHCP? DHCP uses UDP port 67 on the server and UDP port 68 on the client. Which layer protocol is DHCP? DHCP is an application layer protocol. DNS A Domain Name System (DNS) converts a human-readable name (such as www.geeksforgeeks.org) to a numeric IP address. The DNS system responds to one or more IP-address by which your computer connects to a website (such as geeksforgeeks.org) by using one of the IP-address. There is not only one DNS server. There are series of DNS servers used to resolve the domain name. DNS uses cache to work efficiently so that it can quickly refer to DNS lookups it’s already performed rather than performing a DNS lookup over and over again. Although DNS caching increase the speed of the domain name resolution process But the major change in the domain then takes a day to reflect worldwide. DNS Spoofing means getting a wrong entry or IP address of the requested site from the DNS server. Attackers find out the flaws in the DNS system and take control and will redirect to a malicious website. Port security Introduction A growing challenge for network administrators is to be able to control who is allowed - and who isn't - to access the organization's internal network. This access control is mandatory for critical infrastructure protection in your network. It is not on public parts of the network where guest users should be able to connect. Port security is a feature implemented in Cisco Catalyst switches which helps network engineers in implementing network security on network boundaries. In its most basic form, the Port Security feature remembers the MAC address of the device connected to the switch edge port and allows only that MAC address to be active on that port. If any other MAC address is detected on that port, port security feature shutdown the switch port. The switch can be configured to send a SNMP trap to a network monitoring solution to alert that a port is disabled for security reasons. interface FastEthernet0/1 switchport mode access switchport port-security switchport port-security maximum 3 switchport port-security mac-address sticky switchport port-security violation restrict Port Security in Computer Network Last Updated : 15 Mar, 2022 Attackers’ task is comparatively very easy when they can enter the network they want to attack. Ethernet LANs are very much vulnerable to attack as the switch ports are open to use by default. Various attacks such as Dos attack at layer 2, address spoofing can take place. If the administrator has control over the network then obviously the network is safe. To take total control over the switch ports, the user can use a feature called port-security. If somehow prevent an unauthorized user to use these ports, then the security will increase up to a great extent at layer 2. Users can secure a port in two steps: Limiting the number of MAC addresses to a single switch port, i.e if more than the limit, Mac addresses are learned from a single port then appropriate action will be taken. If unauthorized access is observed, the traffic should be discarded by using any of the options, or more appropriately, the user should generate a log message so that unauthorized access can be easily observed. Port security – Switches learn MAC addresses when the frame is forwarded through a switch port. By using port security, users can limit the number of MAC addresses that can be learned to a port, set static MAC addresses, and set penalties for that port if it is used by an unauthorized user. Users can either use restrict, shut down or protect port-security commands. Let’s discuss these violation modes: protect – This mode drops the packets with unknown source mac addresses until you remove enough secure mac addresses to drop below the maximum value. restrict – This mode performs the same function as protecting, i.e drops packets until enough secure mac addresses are removed to drop below the maximum value. In addition to this, it will generate a log message, increment the counter value, and will also send an SNMP trap. shut down – This mode is mostly preferred as compared to other modes as it shut down the port immediately if unauthorized access is done. It will also generate a log, increment counter value, and send an SNMP trap. This port will remain in a shutdown state until the administrator will perform the “no shutdown” command. Sticky – This is not a violation mode. By using the sticky command, the user provides static Mac address security without typing the absolute Mac address. For example, if user provides a maximum limit of 2 then the first 2 Mac addresses learned on that port will be placed in the running configuration. After the 2nd learned Mac address, if the 3rd user wants to access then the appropriate action will be taken according to the violation mode applied. Note – The port security will work on access port only i.e to enable port security, the user first has to make it an access port. Configuration – Applying port-security on fa0/1 interface of switch .first, convert the port to an access port and will enable port-security. S1(config)#int fa0/1 S1(config-if)#switchport mode access S1(config-if)#switchport port-security Use sticky command so that it will learn the Mac address dynamically and will provide the limit and the appropriate action that should be taken. S1(config-if)#switchport port-security mac-address sticky S1(config-if)#switchport port-security maximum 2 S1(config-if)#switchport port-security violation shutdown If the user wants to provide a static entry, then configure that by starting its Mac address. S1(config-if)#switchport port-security S1(config-if)#switchport port-security violation shutdown S1(config-if)#switchport port-security mac-address aa.bb.cc.dd.ee.ff