Loving the videos Chris! Again I am super stoked I found this channel via David Bombal's channel. These videos work out great for me asI was just hired as a Jr system admin. These videos are great reinforcement's to what I already know and the vids are great for real world work environments. Maybe we can dive into some DNS issues that are common since we all know how DNS issues are very common.
Hey David, that is a great idea. I'll put it on my punch list! I appreciate these kinds of comments because it's great feedback about what you guys are seeing out there and what protocols you'd like some tips on troubleshooting.
Chris, thanks a lot. Short, clear & practical explanation. I have a feeling that all of your videos will be so useful to see. +1 subscriber. Thanks for your work.
You make this so clear to me. I am relatively new to networking and have begun working with it at my work. Networking is so interesting and I can't get enough. Thanks.
i found you true john hammond and i am glad i did... you explain this so damn good thank you for your work i followed you and pressed the bell. it fits so perfect on this moment in my work. thank you for your time and effort for doing this. regards from holland....
@@ChrisGreer I am also VERY interested in dissections of routing protocols (especially OSPF, IS-IS and BGP). They would be super interesting and useful. I apologise for asking this again, but these will be really useful in really understanding how routing protocols work.
Hi Chris! At 4:55 minutes "Option: (50) Requested IP Adress" what would it request if the client had never been on the network before? Would option 50 just be missing?
Thanks, FYI to understand the DHCP flow. I'm new to this technology, If we use the password-enabled AP sometimes the DHCP/PING(ICMP) packets are not showing in the wireshark. I have enabled the decryption keys, but the packets are still not decrypted properly. I have added the key to the 802.11 protocol decryption column "password:ssid". How to get the all the time dhcp, icmp(ping) frames in the wireshark? I have tried two ways 1) I have used the airpcap in windows 2) i have used linux laptop in that i have configured the interface as monitor mode with the default wifi card. Both the ways are not helpful. please correct if i did anything wrong.
I've been enjoying the videos about Wireshark. I spend a good portion of my day setting up DHCP servers (DOCSIS Provisioning) for ISPs, and I didn't realize WHY there wasn't good documentation on filters until I saw you drag the item to the filter bar. Shared it with everyone in the office, makes me laugh I missed that. I have all kinds of grep commands on tcpdump -r with recursive find(s). I thought something fun to share would be my fav tcpdump filter, when looking for a MAC. You can't just look for the MAC in a DHCP packet in tcpdump, but you can find the last 4 bytes from the 38th. So say you are looking for MACs ending D2BF0032 or E24D33D2: tcpdump -nnvvi any -s0 port 67 and udp[38:4]=0xD2BF0032 tcpdump -nnvvi any -s0 'port 67 and (udp[38:4]=0xD2BF0032 or udp[38:4]=0xE24D33D2)'
Hey Scott! Nice! glad you found the channel. Thank you for sharing the filters as well. Funny - I was just teaching a Wireshark class this morning and we dug into offset filtering like the one you just shared. I like that filter!
What might be the reason?? I'm using one static IP in specific domain or workgroup why some times some desktop takes different ip even select option static.
Hi Chris, Other than DORA process what are the other packets in DHCP process. Is it true that during request process garp will be sent by requester because we don't see that captures? What if there are more than 1 dhcp server in environment then what will be the process to get tha IP address?
Hi Chris, thanks for explaining it in so simple words. Luv your videos. Can you tell what happens in case static ip is configured on the client, would client still send a discover message or some other ? what happens with static arp ?
Clients CAN send discovers on statics. Lots of people don't do DHCP for statics, and most DHCP services can set the static reservation to non-allocable. I can't tell you how many times big customers that should know better were sending DHCP for years and didn't know it. I even had one major bank upset telling me their MAC was deadbeefcafe, until I read it back to them...
Hi Chris, thanks for explaining One doubt about DHCP offer in your wireshark . While the server sending an offer, clint doesnt carry any ip address. ( or client is yet to get an ip address ) SO at this point how can your server send a unicast OFFER ? is it because "Requested ip " in Discover ?
"SO at this point how can your server send a unicast OFFER ?" "is it because "Requested ip " in Discover ?" The answer is no, doesn't matter if the client suggested the last ip that was used, the communication happens in layer 2, the client doesn't have yet the IP, but doens't matter, the most important thing in this offer packet is the unicast transmission in layer 2 specifying the client mac address, with this information the offer packet can reach the client.
Very thanksful Mr Chris..! All love and respect for you and your amazing video 🌹, But my question is how can i capture DHCP in network, i mean how you get this capture..?
Honestly I just fired up Wireshark, started capturing, then I went out to my command line, typed in ipconfig /release then ipconfig /renew. That was on a windows system. Give it a try!
Hey Chris I like your videos you are very informative. Could you maybe make a video explaining IO graphs and how to view use the graph under statistics tab in wireshark? Thank you for your videos
Ok so, if the discover request finds for example 3 DHCP servers, the client will receive 3 offers and it's only the client will choose one of them? Is that right Chris?
@@ChrisGreer No, I don't have. As you said it is hard to catch :( Maybe it could be done with two VirtualBox machines with host-only network. One VM: as eg. Clonezilla Live DRBL, second machine as a PXE client, and host as Wireshark monitor.
One other thing to look for is some user on the network brought a wireless router (Netgear, TP link, etc.) into the office and connected it to their network port so they could have their own wireless in the office but they don't know how to disable the DHCP service on their router... happened to me a few times back in the day.
In the discover - because the client doesn't know who the DHCP server is. In the offer - the RFC states it can be either a bcast or unicast - some stations won't like to receive a layer 3 bcast offer. However this allows the server to alert any other DHCP servers that another offer is out there. It really just depends on the implementation. Maybe I can go deeper in another video?
About the discover- If the client doesnt know who the dhcp server is, it can still do a layer 2 broadcast and encapsulate the dhcp directly in ethernet (just like how ARP is)and the lets the DHCP server know about this discover? I am just trying to think why the original implementers did it the way it is today..
I am confused... How does the DHCP server unicast it back to the client if the client doesn't have an IP address already, or if the client has never been on that network before? You say the DHCP server sends it back to the IP that the client requested.
If the client had never been there before, with no record of a previous IP, then it will use the broadcast flag and the offer and ack will be broadcasted. In the example, the station had a previous record.
Yep it sure does! Video coming soon. They tried initially to have all the config come from a local neighbor router - but that didn't work well with all the options DHCP can send along with the offer.
@@scottkensai8179 Thanks for the comment. I know it is dizzying with the number of references out there. Thanks for the suggestion. I am going to keep it as simple as possible!
II've been following your videos for a while, and they've helped me a lot. Thank you for that. I have a question... is an NBNS on port 137 normal, especially when it leads to various Microsoft IP addresses? I find it particularly strange that the IPs belong to Microsoft, but the destination MAC shows the MAC of my router. Even when I follow the UDP stream, all I see is something like '.U........ CKAAAAAAAAAAAAAAAAAAAAAA..!..' etc. I would really appreciate an answer, as I would very much like to find out for personal reasons. Thank you very much!!!! Greetings from Austria 🫡
Great Explanation of how DHCP works! Thank you for this Video.
Thanks Vyas!
I haven't watched this video yet but you have no idea how relevant this is to a thing I'm working on right now. Thanks Chris!!
Glad it was helpful! Thanks for the comment.
Loving the videos Chris! Again I am super stoked I found this channel via David Bombal's channel. These videos work out great for me asI was just hired as a Jr system admin. These videos are great reinforcement's to what I already know and the vids are great for real world work environments. Maybe we can dive into some DNS issues that are common since we all know how DNS issues are very common.
Hey David, that is a great idea. I'll put it on my punch list! I appreciate these kinds of comments because it's great feedback about what you guys are seeing out there and what protocols you'd like some tips on troubleshooting.
By the way... check out the dns.time filter!! (dns.time>1) it will find all dns responses that took longer than a second.
Learning Wireshark capture for the first time. Your teaching will help me to expertise the capture analysis. Thank you for such awesome tutorials
Chris, thanks a lot. Short, clear & practical explanation. I have a feeling that all of your videos will be so useful to see. +1 subscriber. Thanks for your work.
This is exactly the way how DHCP should be explained. Great video, despite having experience in managing DHCP servers I've learned something new!
Thanks for the comment!
Hi Tomas,
Can you please share one or two examples of issues you had faced in DHCP and what are the tshoot steps to follow in DHCP. Thanks
You make this so clear to me. I am relatively new to networking and have begun working with it at my work. Networking is so interesting and I can't get enough. Thanks.
Awesome Paul! Welcome to the networking world. 👍
New to the channel, try to binge the videos, this is a great one. Fantastic job, thank you.
Welcome to the channel!
i found you true john hammond and i am glad i did... you explain this so damn good thank you for your work i followed you and pressed the bell. it fits so perfect on this moment in my work. thank you for your time and effort for doing this. regards from holland....
Thank you for your channel. Especially for a simple explanation. Great job.
Dziękujemy.
Thank you!!
Hello Chris, awesome video. One question, the server never gave the device an NTP server? Thank you, Billy
Love the education you are giving for free! May I suggest an IPv6 video for the future?
Yes! Working on an IPv6 DHCP video now
I just can say your contents are amazing. Thanks!
Glad you like them!
Very good explanation. Can you do a video for DHCPv6 and SLAAC? Thanks!
I am working on a dhcpv6 one. Just gotta get a super clean pcap of it!
@@ChrisGreer I am also VERY interested in dissections of routing protocols (especially OSPF, IS-IS and BGP). They would be super interesting and useful. I apologise for asking this again, but these will be really useful in really understanding how routing protocols work.
Hi Chris! At 4:55 minutes "Option: (50) Requested IP Adress" what would it request if the client had never been on the network before? Would option 50 just be missing?
That is exactly it. It wouldn't use that option. Next time i will be sure to demo that too!
@@ChrisGreer pulls up rfc2131, calms down, and realizes this is just an intro vid :)
Thanks a lot Chris ! Keep it up ! 😄
Thanks Faran!
4:10 "Like it woke up, looks at it's arm and saw a tattoo of its' MAC Address" Brilliant Analogy!
Glad you liked it!
this was fascinating and very informative, thanks
Hi Chris,
Could you confirm if the the sever to client communication is always a unicast?
I believe all messages are broadcast.
Once more, simplified and excellent.
Thanks!
Best explaination. Whats about 802.1x, can you make a video about this whole topic?
Glad to have your voice and effort. Do you have plan to give lessons about Tacacs+ and Radius ? Thanks a lot
Really great video Chris
Thank you!
Thanks, FYI to understand the DHCP flow.
I'm new to this technology, If we use the password-enabled AP sometimes the DHCP/PING(ICMP) packets are not showing in the wireshark. I have enabled the decryption keys, but the packets are still not decrypted properly.
I have added the key to the 802.11 protocol decryption column "password:ssid".
How to get the all the time dhcp, icmp(ping) frames in the wireshark?
I have tried two ways 1) I have used the airpcap in windows 2) i have used linux laptop in that i have configured the interface as monitor mode with the default wifi card.
Both the ways are not helpful. please correct if i did anything wrong.
Thanks for the video, Chris!
You are welcome!
I've been enjoying the videos about Wireshark. I spend a good portion of my day setting up DHCP servers (DOCSIS Provisioning) for ISPs, and I didn't realize WHY there wasn't good documentation on filters until I saw you drag the item to the filter bar. Shared it with everyone in the office, makes me laugh I missed that. I have all kinds of grep commands on tcpdump -r with recursive find(s). I thought something fun to share would be my fav tcpdump filter, when looking for a MAC. You can't just look for the MAC in a DHCP packet in tcpdump, but you can find the last 4 bytes from the 38th. So say you are looking for MACs ending D2BF0032 or E24D33D2:
tcpdump -nnvvi any -s0 port 67 and udp[38:4]=0xD2BF0032
tcpdump -nnvvi any -s0 'port 67 and (udp[38:4]=0xD2BF0032 or udp[38:4]=0xE24D33D2)'
Hey Scott! Nice! glad you found the channel. Thank you for sharing the filters as well. Funny - I was just teaching a Wireshark class this morning and we dug into offset filtering like the one you just shared. I like that filter!
Excellent as usual.
Thanks Mr. Brown!
What might be the reason??
I'm using one static IP in specific domain or workgroup why some times some desktop takes different ip even select option static.
Hi Chris,
Other than DORA process what are the other packets in DHCP process.
Is it true that during request process garp will be sent by requester because we don't see that captures?
What if there are more than 1 dhcp server in environment then what will be the process to get tha IP address?
Great i was Just studying this your are gift sir thx and god bless u dont forget to thanks Mr Bombal
For sure! @davidbombal is so generous with all the knowledge he shares!
@@ChrisGreer as u do chris because when we share we live long and happier thata what i whish u chris
Thanks, That's what i was looking for
Great content video as always from Chris.. Thank you so much 🙏🙏😎
Please do a video on Ipv 4 and 6
It's funny you mention that - DHCPv6 is next on my list. :-)
Thanks, I like the tattoo example, on how the client knows its MAC ;)
Wow perfectly explained!
Hi Chris, thanks for explaining it in so simple words. Luv your videos. Can you tell what happens in case static ip is configured on the client, would client still send a discover message or some other ? what happens with static arp ?
Clients CAN send discovers on statics. Lots of people don't do DHCP for statics, and most DHCP services can set the static reservation to non-allocable. I can't tell you how many times big customers that should know better were sending DHCP for years and didn't know it. I even had one major bank upset telling me their MAC was deadbeefcafe, until I read it back to them...
Hi Chris, thanks for explaining
One doubt about DHCP offer in your wireshark .
While the server sending an offer, clint doesnt carry any ip address. ( or client is yet to get an ip address )
SO at this point how can your server send a unicast OFFER ?
is it because "Requested ip " in Discover ?
"SO at this point how can your server send a unicast OFFER ?"
"is it because "Requested ip " in Discover ?"
The answer is no, doesn't matter if the client suggested the last ip that was used, the communication happens in layer 2, the client doesn't have yet the IP, but doens't matter, the most important thing in this offer packet is the unicast transmission in layer 2 specifying the client mac address, with this information the offer packet can reach the client.
Very thanksful Mr Chris..! All love and respect for you and your amazing video 🌹, But my question is how can i capture DHCP in network, i mean how you get this capture..?
Honestly I just fired up Wireshark, started capturing, then I went out to my command line, typed in ipconfig /release then ipconfig /renew. That was on a windows system. Give it a try!
Great videos! thanks 🙏
Hey Chris I like your videos you are very informative. Could you maybe make a video explaining IO graphs and how to view use the graph under statistics tab in wireshark? Thank you for your videos
Great suggestion!
Ok so, if the discover request finds for example 3 DHCP servers, the client will receive 3 offers and it's only the client will choose one of them? Is that right Chris?
That is correct. The client will select one of them using the request function.
Great video!
Thanks!
Your likes on this video was at 404 I couldn't rest until it was at least one higher ;) Great videos by the way!
Good job Chris :)
Is it possible to extend this video by PXE boot?
Hey JFK! Thanks for the comment. Do you happen to have a pcap of it? Willing to share? I don't see it too often so it's tough to catch...
@@ChrisGreer No, I don't have. As you said it is hard to catch :(
Maybe it could be done with two VirtualBox machines with host-only network. One VM: as eg. Clonezilla Live DRBL, second machine as a PXE client, and host as Wireshark monitor.
Thanks Chris!
One other thing to look for is some user on the network brought a wireless router (Netgear, TP link, etc.) into the office and connected it to their network port so they could have their own wireless in the office but they don't know how to disable the DHCP service on their router... happened to me a few times back in the day.
Totally! That is where looking for multiple offers can help. Or MACs that are registered to Netgear, etc. 👍
what was th reason for making it bcast at layer 3 and what advantage it is bringing in?
In the discover - because the client doesn't know who the DHCP server is. In the offer - the RFC states it can be either a bcast or unicast - some stations won't like to receive a layer 3 bcast offer. However this allows the server to alert any other DHCP servers that another offer is out there. It really just depends on the implementation. Maybe I can go deeper in another video?
About the discover- If the client doesnt know who the dhcp server is, it can still do a layer 2 broadcast and encapsulate the dhcp directly in ethernet (just like how ARP is)and the lets the DHCP server know about this discover? I am just trying to think why the original implementers did it the way it is today..
I am confused... How does the DHCP server unicast it back to the client if the client doesn't have an IP address already, or if the client has never been on that network before? You say the DHCP server sends it back to the IP that the client requested.
If the client had never been there before, with no record of a previous IP, then it will use the broadcast flag and the offer and ack will be broadcasted. In the example, the station had a previous record.
Yeah I also have same query.
Thank you Chris
Very welcome
Thanks you for the video
My pleasure!
great stuff
Thanks!
Does DHCP over IPv6 exist? What ports does it use? Different on Windows, Linux, and Mac?
@@asd81907 Thank you!
Yep it sure does! Video coming soon. They tried initially to have all the config come from a local neighbor router - but that didn't work well with all the options DHCP can send along with the offer.
@@ChrisGreer Let's start with discussing PDs, and the other 50+ supporting RFCs. I still talk 3315, and have to push to 8415 some days.
@@scottkensai8179 Thanks for the comment. I know it is dizzying with the number of references out there. Thanks for the suggestion. I am going to keep it as simple as possible!
Thanks!
You are welcome
You’re amazing
Thanks for watching!
Nice
Sometimes you find gold in this never ending pile of shit of a platform. Thank you!
Awesomeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee
Sir, this channel is illegal , you can't be that good .
Great demonstration, super clear and easy to understand. Thanks a lot!
Garcia Betty Walker Nancy Wilson Robert
Taylor Linda Smith Karen Hernandez Maria
II've been following your videos for a while, and they've helped me a lot. Thank you for that.
I have a question... is an NBNS on port 137 normal, especially when it leads to various Microsoft IP addresses?
I find it particularly strange that the IPs belong to Microsoft, but the destination MAC shows the MAC of my router.
Even when I follow the UDP stream, all I see is something like '.U........ CKAAAAAAAAAAAAAAAAAAAAAA..!..' etc.
I would really appreciate an answer, as I would very much like to find out for personal reasons.
Thank you very much!!!!
Greetings from Austria 🫡