How DHCP Works // DHCP EXPLAINED

[@vyasG]

Great Explanation of how DHCP works! Thank you for this Video.

[@ChrisGreer]

Thanks Vyas!

[@alandoran]

I haven't watched this video yet but you have no idea how relevant this is to a thing I'm working on right now. Thanks Chris!!

[@ChrisGreer]

Glad it was helpful! Thanks for the comment.

[@anitarajendran1097]

Learning Wireshark capture for the first time. Your teaching will help me to expertise the capture analysis. Thank you for such awesome tutorials

[@paulphillips6170]

You make this so clear to me. I am relatively new to networking and have begun working with it at my work. Networking is so interesting and I can't get enough. Thanks.

[@ChrisGreer]

Awesome Paul! Welcome to the networking world. 👍

[@tomaschyla4111]

This is exactly the way how DHCP should be explained. Great video, despite having experience in managing DHCP servers I've learned something new!

[@ChrisGreer]

Thanks for the comment!

[@ashishsolanki86]

Hi Tomas, Can you please share one or two examples of issues you had faced in DHCP and what are the tshoot steps to follow in DHCP. Thanks

[@davdiaz24]

Loving the videos Chris! Again I am super stoked I found this channel via David Bombal's channel. These videos work out great for me asI was just hired as a Jr system admin. These videos are great reinforcement's to what I already know and the vids are great for real world work environments. Maybe we can dive into some DNS issues that are common since we all know how DNS issues are very common.

[@ChrisGreer]

Hey David, that is a great idea. I'll put it on my punch list! I appreciate these kinds of comments because it's great feedback about what you guys are seeing out there and what protocols you'd like some tips on troubleshooting.

[@ChrisGreer]

By the way... check out the dns.time filter!! (dns.time>1) it will find all dns responses that took longer than a second.

[@tedsatim3555]

Thank you for your channel. Especially for a simple explanation. Great job.

[@33t00p]

Chris, thanks a lot. Short, clear & practical explanation. I have a feeling that all of your videos will be so useful to see. +1 subscriber. Thanks for your work.

[@aba-nascu]

Best explaination. Whats about 802.1x, can you make a video about this whole topic?

[@paulodagraca3469]

New to the channel, try to binge the videos, this is a great one. Fantastic job, thank you.

[@ChrisGreer]

Welcome to the channel!

[@danielschuitemaker5208]

i found you true john hammond and i am glad i did... you explain this so damn good thank you for your work i followed you and pressed the bell. it fits so perfect on this moment in my work. thank you for your time and effort for doing this. regards from holland....

[@Jonathan-jk7of]

Please do a video on Ipv 4 and 6

[@ChrisGreer]

It's funny you mention that - DHCPv6 is next on my list. :-)

[@konstantinosprotopapas588]

Very good explanation. Can you do a video for DHCPv6 and SLAAC? Thanks!

[@ChrisGreer]

I am working on a dhcpv6 one. Just gotta get a super clean pcap of it!

[@konstantinosprotopapas588]

@@ChrisGreer I am also VERY interested in dissections of routing protocols (especially OSPF, IS-IS and BGP). They would be super interesting and useful. I apologise for asking this again, but these will be really useful in really understanding how routing protocols work.

[@billybuck2713]

Hello Chris, awesome video. One question, the server never gave the device an NTP server? Thank you, Billy

[@kelak1296]

Thanks for the video, Chris!

[@ChrisGreer]

You are welcome!

[@bierowns]

Love the education you are giving for free! May I suggest an IPv6 video for the future?

[@ChrisGreer]

Yes! Working on an IPv6 DHCP video now

[@jiyaneren5019]

Glad to have your voice and effort. Do you have plan to give lessons about Tacacs+ and Radius ? Thanks a lot

[@laurenslabejof5898]

this was fascinating and very informative, thanks

[@scottkensai8179]

I've been enjoying the videos about Wireshark. I spend a good portion of my day setting up DHCP servers (DOCSIS Provisioning) for ISPs, and I didn't realize WHY there wasn't good documentation on filters until I saw you drag the item to the filter bar. Shared it with everyone in the office, makes me laugh I missed that. I have all kinds of grep commands on tcpdump -r with recursive find(s). I thought something fun to share would be my fav tcpdump filter, when looking for a MAC. You can't just look for the MAC in a DHCP packet in tcpdump, but you can find the last 4 bytes from the 38th. So say you are looking for MACs ending D2BF0032 or E24D33D2: tcpdump -nnvvi any -s0 port 67 and udp[38:4]=0xD2BF0032 tcpdump -nnvvi any -s0 'port 67 and (udp[38:4]=0xD2BF0032 or udp[38:4]=0xE24D33D2)'

[@ChrisGreer]

Hey Scott! Nice! glad you found the channel. Thank you for sharing the filters as well. Funny - I was just teaching a Wireshark class this morning and we dug into offset filtering like the one you just shared. I like that filter!

[@DavidMills1222]

I just can say your contents are amazing. Thanks!

[@ChrisGreer]

Glad you like them!

[@bojo8981]

Thanks Chris!

[@VictorMoreno-xd7en]

Thanks, I like the tattoo example, on how the client knows its MAC ;)

[@ohasis8331]

Once more, simplified and excellent.

[@ChrisGreer]

Thanks!

[@faran_siddiqui-d3t]

Thanks a lot Chris ! Keep it up ! 😄

[@ChrisGreer]

Thanks Faran!

[@rivkas2224]

Wow perfectly explained!

[@akhildamodaran736]

Hi Chris, Could you confirm if the the sever to client communication is always a unicast? I believe all messages are broadcast.

[@majiddehbi9186]

Great i was Just studying this your are gift sir thx and god bless u dont forget to thanks Mr Bombal

[@ChrisGreer]

For sure! @davidbombal is so generous with all the knowledge he shares!

[@majiddehbi9186]

@@ChrisGreer as u do chris because when we share we live long and happier thata what i whish u chris

[@baskarnataraj2042]

Thanks, FYI to understand the DHCP flow. I'm new to this technology, If we use the password-enabled AP sometimes the DHCP/PING(ICMP) packets are not showing in the wireshark. I have enabled the decryption keys, but the packets are still not decrypted properly. I have added the key to the 802.11 protocol decryption column "password:ssid". How to get the all the time dhcp, icmp(ping) frames in the wireshark? I have tried two ways 1) I have used the airpcap in windows 2) i have used linux laptop in that i have configured the interface as monitor mode with the default wifi card. Both the ways are not helpful. please correct if i did anything wrong.

[@mrbrown6421]

Excellent as usual.

[@ChrisGreer]

Thanks Mr. Brown!

[@sri9277]

Really great video Chris

[@ChrisGreer]

Thank you!

[@benjaminolusola5559]

Thank you Chris

[@ChrisGreer]

Very welcome

[@KRICHAN_Technologies]

Great content video as always from Chris.. Thank you so much 🙏🙏😎

[@snr7242]

What might be the reason?? I'm using one static IP in specific domain or workgroup why some times some desktop takes different ip even select option static.

[@alimibrahem8120]

Very thanksful Mr Chris..! All love and respect for you and your amazing video 🌹, But my question is how can i capture DHCP in network, i mean how you get this capture..?

[@ChrisGreer]

Honestly I just fired up Wireshark, started capturing, then I went out to my command line, typed in ipconfig /release then ipconfig /renew. That was on a windows system. Give it a try!

[@dwaynesudduth1028]

4:10 "Like it woke up, looks at it's arm and saw a tattoo of its' MAC Address" Brilliant Analogy!

[@ChrisGreer]

Glad you liked it!

[@ashishsolanki86]

Hi Chris, Other than DORA process what are the other packets in DHCP process. Is it true that during request process garp will be sent by requester because we don't see that captures? What if there are more than 1 dhcp server in environment then what will be the process to get tha IP address?

[@loganwolf3524]

Hey Chris I like your videos you are very informative. Could you maybe make a video explaining IO graphs and how to view use the graph under statistics tab in wireshark? Thank you for your videos

[@ChrisGreer]

Great suggestion!

[@pivot3india]

Hi Chris, thanks for explaining it in so simple words. Luv your videos. Can you tell what happens in case static ip is configured on the client, would client still send a discover message or some other ? what happens with static arp ?

[@scottkensai8179]

Clients CAN send discovers on statics. Lots of people don't do DHCP for statics, and most DHCP services can set the static reservation to non-allocable. I can't tell you how many times big customers that should know better were sending DHCP for years and didn't know it. I even had one major bank upset telling me their MAC was deadbeefcafe, until I read it back to them...

[@Jonathan-jk7of]

Thanks you for the video

[@ChrisGreer]

My pleasure!

[@paulstaf]

One other thing to look for is some user on the network brought a wireless router (Netgear, TP link, etc.) into the office and connected it to their network port so they could have their own wireless in the office but they don't know how to disable the DHCP service on their router... happened to me a few times back in the day.

[@ChrisGreer]

Totally! That is where looking for multiple offers can help. Or MACs that are registered to Netgear, etc. 👍

[@sureshpararath]

Hi Chris, thanks for explaining One doubt about DHCP offer in your wireshark . While the server sending an offer, clint doesnt carry any ip address. ( or client is yet to get an ip address ) SO at this point how can your server send a unicast OFFER ? is it because "Requested ip " in Discover ?

[@TheInnocentCriminals]

"SO at this point how can your server send a unicast OFFER ?" "is it because "Requested ip " in Discover ?" The answer is no, doesn't matter if the client suggested the last ip that was used, the communication happens in layer 2, the client doesn't have yet the IP, but doens't matter, the most important thing in this offer packet is the unicast transmission in layer 2 specifying the client mac address, with this information the offer packet can reach the client.

[@christiangrenier9434]

Ok so, if the discover request finds for example 3 DHCP servers, the client will receive 3 offers and it's only the client will choose one of them? Is that right Chris?

[@ChrisGreer]

That is correct. The client will select one of them using the request function.

[@notnull01]

Great videos! thanks 🙏

[@arturk.2230]

Dziękujemy.

[@ChrisGreer]

Thank you!!

[@LasLars2]

Hi Chris! At 4:55 minutes "Option: (50) Requested IP Adress" what would it request if the client had never been on the network before? Would option 50 just be missing?

[@ChrisGreer]

That is exactly it. It wouldn't use that option. Next time i will be sure to demo that too!

[@scottkensai8179]

@@ChrisGreer pulls up rfc2131, calms down, and realizes this is just an intro vid :)

[@christopherkushner2362]

Great video!

[@ChrisGreer]

Thanks!

[@franek4always]

Good job Chris :) Is it possible to extend this video by PXE boot?

[@ChrisGreer]

Hey JFK! Thanks for the comment. Do you happen to have a pcap of it? Willing to share? I don't see it too often so it's tough to catch...

[@franek4always]

@@ChrisGreer No, I don't have. As you said it is hard to catch :( Maybe it could be done with two VirtualBox machines with host-only network. One VM: as eg. Clonezilla Live DRBL, second machine as a PXE client, and host as Wireshark monitor.

[@techevangelist8373]

what was th reason for making it bcast at layer 3 and what advantage it is bringing in?

[@ChrisGreer]

In the discover - because the client doesn't know who the DHCP server is. In the offer - the RFC states it can be either a bcast or unicast - some stations won't like to receive a layer 3 bcast offer. However this allows the server to alert any other DHCP servers that another offer is out there. It really just depends on the implementation. Maybe I can go deeper in another video?

[@techevangelist8373]

About the discover- If the client doesnt know who the dhcp server is, it can still do a layer 2 broadcast and encapsulate the dhcp directly in ethernet (just like how ARP is)and the lets the DHCP server know about this discover? I am just trying to think why the original implementers did it the way it is today..

[@themistoclesnelson2163]

Thanks!

[@ChrisGreer]

You are welcome

[@AB-fj5wi]

great stuff

[@ChrisGreer]

Thanks!

[@RedBlueLabs]

Your likes on this video was at 404 I couldn't rest until it was at least one higher ;) Great videos by the way!

[@thecandybeast]

Does DHCP over IPv6 exist? What ports does it use? Different on Windows, Linux, and Mac?

[@thecandybeast]

@@asd81907 Thank you!

[@ChrisGreer]

Yep it sure does! Video coming soon. They tried initially to have all the config come from a local neighbor router - but that didn't work well with all the options DHCP can send along with the offer.

[@scottkensai8179]

@@ChrisGreer Let's start with discussing PDs, and the other 50+ supporting RFCs. I still talk 3315, and have to push to 8415 some days.

[@ChrisGreer]

@@scottkensai8179 Thanks for the comment. I know it is dizzying with the number of references out there. Thanks for the suggestion. I am going to keep it as simple as possible!

[@BoniShadat]

Nice

[@paulstaf]

I am confused... How does the DHCP server unicast it back to the client if the client doesn't have an IP address already, or if the client has never been on that network before? You say the DHCP server sends it back to the IP that the client requested.

[@ChrisGreer]

If the client had never been there before, with no record of a previous IP, then it will use the broadcast flag and the offer and ack will be broadcasted. In the example, the station had a previous record.

[@chetandurgavale5623]

Yeah I also have same query.

[@kmonet-wn9nf]

You’re amazing

[@ChrisGreer]

Thanks for watching!

[@NobleSteed00]

Sometimes you find gold in this never ending pile of shit of a platform. Thank you!

[@TheStormOfKnowledge]

Awesomeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee

[@MelissaPerez-d5g]

Garcia Betty Walker Nancy Wilson Robert

[@LoisPrice-k4y]

Taylor Linda Smith Karen Hernandez Maria

[@malokbuyred2495]

Sir, this channel is illegal , you can't be that good .

[@greob]

Great demonstration, super clear and easy to understand. Thanks a lot!

[@Mieziiiii]

II've been following your videos for a while, and they've helped me a lot. Thank you for that. I have a question... is an NBNS on port 137 normal, especially when it leads to various Microsoft IP addresses? I find it particularly strange that the IPs belong to Microsoft, but the destination MAC shows the MAC of my router. Even when I follow the UDP stream, all I see is something like '.U........ CKAAAAAAAAAAAAAAAAAAAAAA..!..' etc. I would really appreciate an answer, as I would very much like to find out for personal reasons. Thank you very much!!!! Greetings from Austria 🫡