Droms R. The DHCP handbook
Подождите немного. Документ загружается.
A Network with One-Year Leases
On Day 1, several DHCP computers and devices start up in this network. The first, a
DHCP-configured laser printer, sends two DHCP messages to the server to obtain its
IP address. This printer never moves and is never powered off, so it keeps its address,
and people use it via its IP address. After half of the lease expires, six months after
Day 1, the printer renews its lease by sending a message to the DHCP server. Six
months later, it renews its lease again. The DHCP server processes a total of four
messages from the printer in the course of one year.
The second device, a DHCP-configured workstation, also starts up on Day 1. It
receives its DHCP lease and is fully functional on the network. Each night, this
device is turned off. Every morning, it is turned back on and sends one DHCP
message to the server to confirm its IP address and to extend its lease on the address.
The DHCP server receives one DHCP message per day from this device.
The third device, a mobile laptop, starts up in one subnet on Day 1 and sends two
messages to the DHCP server to obtain an address with a one-year lease. The next
day, it starts up in a different subnet and gets another address with a one-year lease.
The third day, it starts up in a third subnet and gets yet another address with a one-
year lease. The laptop, therefore, has an address with a one-year lease on each subnet
to which it has been connected.
When the administrator changes a parameter for DHCP clients, the server returns
that new value to DHCP clients in the next message it sends to each client. However,
because the protocol relies on the client to initiate communication, any change to a
DHCP option is not sent to a DHCP client until the client sends a message to the
server. Therefore, on this network, the printer doesn’t see a change to a DHCP
option for six months. The workstation and desktop system receive the new parame-
ter value more quickly because they contact the server each time they are powered
on, but even 24 hours might be too long to wait for changes to DHCP options to
propagate to DHCP clients.
Long leases can also lead to exhaustion of the pool of addresses that are available for
dynamic assignment by the DHCP server. Because the server must wait until the
lease expires before reassigning an address to a new client, every device that
connects to the network—even a laptop that is connected for only a few hours—is
assigned an address that can’t be reused for one year. Over time, many addresses
may no longer be in use but may not be reused because the leases for those
addresses have not expired.
When subnets are assigned new IP addresses, or are renumbered, another problem can
appear. The laptop and workstation are renumbered according to the new subnet
address as soon as they restart. The printer, which is left powered on all the time, is
not assigned an IP address on the new network until it extends the lease on its
address, which could be as long as six months after the network is renumbered.
CHAPTER 19 Tuning a DHCP Service326
023 3273 CH19 10/3/02 4:58 PM Page 326
LONG LEASE TIMES: BENEFITS AND PROBLEMS
The following are the benefits of long lease times:
• Address assignments are stable.
•No renumbering is needed.
•DHCP packet traffic is low.
• The impact of DHCP server outages is limited (see Chapter 15, “Configuring a DHCP
Server”).
The following are the problems related to long lease times:
• Leases don’t expire, and address allocation pools can be depleted.
• Changes to DHCP option values aren’t propagated quickly.
•Networks can’t be renumbered automatically.
A Network with One-Minute Leases
On Day 1, several DHCP computers and devices start up in this network. The first, a
laser printer that uses DHCP, sends two messages to the DHCP server to obtain an IP
address. As in the previous example, this printer never moves and is never powered
off. After 30 seconds (half of the lease interval) pass, the client sends the DHCP
server a request to renew the lease. This happens every 30 seconds, meaning that in
any given day, the DHCP server processes 2,880 lease renewals for this printer. Over
the course of one year, the server processes more than one million requests from this
printer.
The second device, a DHCP-configured workstation, also starts up on Day 1. It
receives its address by sending two messages to the server, and it is fully functional
on the network. The workstation also renews its lease every 30 seconds while it is
powered up and on the network. Each night, this workstation is turned off. The
workstation’s lease on the address expires one minute after it is turned off. Every
morning, when the workstation is turned back on, it obtains a new address from the
server because the lease on its previous address has expired. Because the lease has
expired, the server can give to another client the IP address that was previously
assigned to the workstation. The workstation might or might not get the same IP
address each day.
The third device, a mobile laptop, starts up in one subnet on Day 1 and gets a one-
minute lease. While on this subnet, it renews its lease every 30 seconds. The lease
expires one minute after the laptop is turned off. The next day, the laptop starts up
on a different subnet and gets another one-minute lease. The third day, the laptop
starts up on a third subnet and gets yet another one-minute lease. Because the leases
are short, they always expire before the laptop connects to a new subnet, and the
client has only one lease at any given point. While the client is connected to the
network, it renews its lease every 30 seconds, by sending a message to the DHCP
server.
Configuring Lease Lengths 327
023 3273 CH19 10/3/02 4:58 PM Page 327
Suppose the administrator of this network changes a network parameter. The server
passes that new value to DHCP clients in the next packet it sends to each client.
Because each client sends a message to the DHCP server to extend the lease on its
assigned address every 30 seconds, any change to a network parameter is delivered
to the DHCP clients almost immediately.
Also, because the DHCP client’s lease expires soon after the client is turned off, leases
for unused addresses on each subnet do not become stale. Thus, as more and more
devices are added to subnets in this network, the likelihood of running out of IP
addresses in a dynamic pool is small.
When subnets are renumbered in this network, the computers are renumbered
within 30 seconds if they are connected to the network or the next time they are
turned on.
SHORT LEASE TIMES: BENEFITS AND PROBLEMS
The following are the benefits of short lease times:
• Changes propagate to the DHCP clients quickly.
•DHCP dynamic pool depletion is unlikely.
•When the network is renumbered, clients get addresses on their new subnets very
quickly.
The following are the problems related to short lease times:
•Clients’ IP addresses may change frequently.
• Leases expire overnight.
• Short lease times can cause a heavy load on the DHCP server.
•DHCP service must be highly available because even a short outage terminates network
service for all clients.
One Lease per Client
As described in the section “A Network with One-Year Leases,” scope depletion in a
network is possible when you use long lease times. This happens because the DHCP
server grants multiple leases to a single client as it moves across subnets.
You can configure the ISC DHCP server to enable only one assigned address for each
DHCP client. When this feature is enabled, the server terminates any existing leases
when it assigns a new address to a DHCP client. As a laptop roams across subnets, it
has only one lease at a time, preventing the DHCP server from depleting its dynamic
pools unnecessarily.
CHAPTER 19 Tuning a DHCP Service328
023 3273 CH19 10/3/02 4:58 PM Page 328
Tradeoffs Between Number of Clients and Lease Length
Generally, it is a bad idea to attach to a network segment more computers than there
are available IP addresses. It is possible to share the available addresses with DHCP, as
long as only as many computers are turned on at once as you have available
addresses. If you have nearly as many computers on a network segment as available
addresses, you must keep lease times relatively short to avoid running out
of available addresses due to unexpired leases on unused addresses.
USING SHORT-TERM LEASES IN A PUBLIC ACCESS NETWORK
At a recent technical convention, the terminal room had a large table with network connec-
tions for attendees to use for their laptop computers. Attendees wandered in and out of the
terminal room, connecting and disconnecting their laptop computers. Unfortunately, a limited
number of IP addresses were available to assign. The terminal room staff initially chose a lease
interval of one hour. The turnover rate of users of the terminal room was quite a bit shorter
than this, so the pool of available IP addresses was quickly depleted. When this occurred, new
arrivals in the terminal room were unable to get IP addresses when they first connected to the
network, but they mysteriously received IP address assignments if they waited long enough.
After adjusting the lease interval to 15 minutes, this problem was virtually eliminated.
The Effect of Lease Length on DHCP Server Load
One consideration when deploying DHCP, and when tuning the parameters of the
DHCP server, is how a given parameter affects the load on the DHCP server. In the
example in section “A Network with One-Minute Leases,” a DHCP server managing
10,000 clients would have to process 300 DHCP messages per second. Although
there are DHCP servers that can handle 300 transactions per second, that transaction
rate represents a significant load on a DHCP server. In comparison, a lease length of
one hour would result in an average load of only five DHCP messages per second,
which would place only a negligible load on a DHCP server computer.
The Effect of Lease Length on Reliability
This topic is discussed in detail in Chapter 14, so it’s described briefly here. If you are
providing DHCP service on a given network segment using only a single DHCP
server, clients cannot renew leases whenever that server is not operating. If the
DHCP server might stop operating for an extended period of time (for example, a
long weekend while no network support staff are available), it might be wise to
choose a lease interval that enables DHCP clients to continue operating if the server
fails. Even if the server is very reliable, you may need to shut it down for mainte-
nance from time to time, so the lease interval you choose should be long enough
that network users are not inconvenienced by a server outage.
Configuring Lease Lengths 329
023 3273 CH19 10/3/02 4:58 PM Page 329
DHCP Leases with DDNS Updates
RFC 2136, “Dynamic DNS (DDNS) Updates,” defines a mechanism through which
DNS data may be more closely tied to DHCP lease data. Because of RFC 2136, DNS
data is itself dynamic and time based. When a new DHCP lease is granted, a DDNS
update is performed to change the DNS information for the DHCP client. The details
of the process through which a DHCP server can update DNS information are
described in more detail in Chapter 11, “DHCP–DDNS Interaction.”
If the DHCP client leaves the network and the lease expires, the DHCP server must
delete the DNS information for the client. However, if the DHCP client stays on the
network, periodically renewing its lease, the information in the DNS servers can
remain unchanged. This fact, coupled with the way that changes to DNS are propa-
gated through a network, leads to an obvious recommendation for DHCP lease time
in DDNS implementations: The DHCP lease time should be at least twice as long as
the longest down time that a DHCP client normally experiences. In most networks,
this is some event such as a three- or four-day weekend. A DHCP lease time of eight
days ensures that even if the DHCP client shuts down just before it renews its lease
(leaving four days and one second on the lease), the lease doesn’t expire when the
client returns. This prevents unnecessary changes to the DNS namespace.
It might be better, however, to simply provide static IP address allocations for DHCP
clients that require a consistent and reliable presence on the network and to config-
ure the DNS records for those clients statically.
DHCP Renew Time
As noted earlier in this chapter, a long lease time on a network leads to a long delay
between changes to network parameters and to delivery of the new parameter values
to DHCP clients. By default, the DHCP client attempts to renew its DHCP lease after
one-half of the duration of the lease expires. However, you can configure the server
to send the
T1 option, which overrides the default time the client uses for DHCP
lease renewal. Setting this parameter to a low value causes DHCP clients to commu-
nicate with the DHCP server more frequently, without running the risk of causing
the DHCP lease to expire. The ISC server uses the dhcp-renewal-time statement to
configure the value sent in the T1 option.
For instance, suppose you set the DHCP lease time to eight days. Using the default
renewal time, a DHCP client renews its lease every four days. If you set the renewal
time to 12 hours, all the DHCP clients on the network would renew their leases and
get any new parameter values within 12 hours. Of course, this solution doesn’t solve
the problem of unexpired leases on unused addresses, but it does enable you to
reduce the number of unwanted lease expirations by using longer leases while deliv-
ering new parameter values to clients quickly.
CHAPTER 19 Tuning a DHCP Service330
023 3273 CH19 10/3/02 4:58 PM Page 330
Customizing Lease Durations
Some DHCP servers enable you to choose different lease intervals for different DHCP
clients. If your DHCP server provides this capability, you might want to configure
your DHCP server to provide shorter lease lengths to laptop computers than to
desktop workstations and still longer lease lengths to devices that are always present
and whose IP addresses are unlikely to change. Chapter 16, “Client Identification
and Fixed-Address Allocation,” describes ways of classifying clients into groups to
which you can give different lease lengths based on their particular needs.
Making Adjustments to Lease Durations
As noted previously, if you choose to renumber your network, having a long lease
interval can be very inconvenient. One way to resolve this problem without using
short leases all the time is to change the DHCP server configuration in anticipation
of a network renumbering. If you choose to provide seven-day leases by default,
seven days before the day on which you renumber your network, you might shorten
the maximum lease duration to six hours. When the network renumbering is
complete, you can once again lengthen the lease interval to seven days.
Reaching a Compromise on Lease Length
Using a few simple, rules, you can choose a DHCP lease time and DHCP renew time
that best fit your needs:
• Keep the DHCP message rate as low as possible. Although DHCP service
doesn’t require large amounts of processing and system resources, minimizing
DHCP traffic is a good idea.
• If DDNS is deployed, or if you are not providing redundant DHCP service, set
the DHCP lease time to a value that is sufficiently large to prevent DHCP leases
from expiring over long weekends.
• If you require rapid propagation of changes to DHCP options, use a short
DHCP renewal time (
T1 option).
Configuring the Lease Length on the DHCP Server
After you choose a policy for assigning the lease, you must configure the DHCP
server to provide appropriate leases to clients. Different DHCP servers handle this
task in different ways.
The Microsoft DHCP server enables you to configure a maximum lease length for
each scope (that is, each subnet). If a DHCP client doesn’t request any particular
lease length, it is assigned the maximum. If the DHCP client requests a lease length
that is less than the maximum, it is assigned a lease with that duration. If it requests
a lease longer than the maximum length, it is assigned a lease of the maximum
length.
Configuring Lease Lengths 331
023 3273 CH19 10/3/02 4:58 PM Page 331
You can configure the ISC DHCP server in any given scope with minimum,
maximum, and default lease lengths. The minimum is provided because many
DHCP clients specifically request a particular lease length, and if the administrator
uses long lease intervals to increase reliability, this benefit cannot be obtained
without requiring such clients to take longer leases. For example, the Microsoft
DHCP client always requests a 24-hour lease.
Example 19.1 shows an ISC DHCP server configuration that sets appropriate
minimum, default, and maximum lease durations for a network with a single DHCP
server that you expect is reliable but that you may need to restart from time to time.
Example 19.1
default-lease-time 7200;
max-lease-time 86400;
min-lease-time 7200;
Remember that these parameters can be different in every scope. This means that,
for example, it is possible to globally declare the maximum lease length to be one
day but then provide servers that have static IP address allocations with a maximum
lease of one month.
Monitoring the Server
You can use SNMP to monitor the operation of network devices via protocol
messages. Any device managed by SNMP has an associated MIB that defines the
information on the device that is to be monitored via SNMP.
The DHC working group of the IETF has produced a draft DHCP server MIB,
authored by R. B. Hibbs and G. Waters. This section describes the use of SNMP and
the DHCP server MIB for gathering operational statistics and server configuration
information.
To use the information defined by the DHCP server MIB, you use an SNMP manage-
ment station to contact the DHCP server and fetch the information about the server
operation that is of interest to you. The SNMP management station is configured to
poll the DHCP server, gather and correlate information, and, when necessary, gener-
ate alarms, email messages, pages, and so on, to inform network administrators of
problems with the DHCP server.
Gathering and Using Traffic Statistics
Traffic and usage statistics are useful parameters to monitor. Significant increases or
decreases in traffic on a given server generally indicate a change or an event that the
system administrator should investigate. The DHCP server MIB defines several
CHAPTER 19 Tuning a DHCP Service332
023 3273 CH19 10/3/02 4:58 PM Page 332
objects that you can use to determine traffic statistics. Most notably, you can
compute the total number of DHCP and BOOTP packets the server receives and
sends by adding the total count numbers for each message type. The MIB also
includes information about message response time, and this helps you understand
how any load on the server is affecting system performance.
On your network, you might configure the management stations to alert you if the
total number of packets you receive is more than 30% higher than the total number
of packets sent. You might also choose to be alerted if the total number of packets
you receive in a one-hour period exceeds a threshold level. If you know that your
DHCP server can handle a packet arrival rate of only 50 packets per second without
excessive latency, seeing a packet arrival rate of 1,000 packets per hour indicates that
you are likely to have a serious problem with your DHCP service. If the message
response time exceeds 3.5 seconds, you might also generate an alarm because the
server is nearing the maximum response latency that the protocol enables.
NOTE
The ISC DHCP server generates an entry in its log file for every DHCP message it processes.
You can easily extract information about the activity levels in the server by parsing the log file
with a program such as a Perl script.
Verifying Server Configuration
It should be obvious that server configuration is critical to reliable DHCP service. In a
dynamic network, it is especially critical. Changes to subnets and to the DHCP server
must occur simultaneously. Any inconsistency between the physical network and the
DHCP server’s view of the subnets and netmasks on the network results in a failure
of DHCP service.
The DHCP server MIB provides a number of server configuration objects that give
specific details about the configuration state of the server. The MIB includes informa-
tion about subnets and subnet masks, secondary (equivalent) subnets, dynamic pool
ranges, dynamic pool usage, static addresses, dynamic addresses, and reserved
addresses. This information enables the SNMP management station to view the
entire server configuration.
In a real-world network, the SNMP management station should either know or
discover information about the subnets on a network. You can then configure the
management station to compare what it thinks about the network with the DHCP
server’s list of subnets and masks and to generate an alarm of some sort if they are
mismatched. This is much better than the old method of waiting for someone to
complain that he or she can’t get a lease!
Monitoring the Server 333
023 3273 CH19 10/3/02 4:58 PM Page 333
DHCP Address Pool Depletion
The most common error a properly configured DHCP server encounters is DHCP
dynamic pool depletion. Imagine the following scenario: Your company is having a
training seminar in a large room, with a network hub on Subnet A. One of the orga-
nizers of the seminar brings in a couple of Ethernet hubs and daisy-chains two 12-
port hubs from one Ethernet port. Then, 20 people bring their laptops into the
room, plug them in, and try to get DHCP leases in Subnet A (they all normally work
in a different building, hence on a different subnet). Suddenly, 20 more devices than
expected are in Subnet A. Unfortunately, only 19 leases are available on that subnet.
Someone doesn’t get an address and calls the help desk.
The DHCP server MIB enables a method to automatically catch occurrences such as
this. As mentioned previously, some MIB objects define the DHCP dynamic pool
ranges, as well as the usage of a dynamic pool. You can configure the network
management station to generate an alarm if a dynamic pool falls below, for example,
15% availability so that problems such as the one described here are discovered
before they escalate.
Monitoring Address Pool Usage
You can check the status of any scope that the Microsoft DHCP server manages
through the DHCP Manager application, as described in Chapter 13, “The Microsoft
DHCP Server.” To determine the number of available addresses in a pool managed by
the ISC server, you must have a program that determines the active leases in the
pool from the leases file and the number of addresses in the pool from the configu-
ration file. You subtract the number of active leases from the total available addresses
to find the number of available addresses. Several Perl scripts are available that
perform this task.
Summary
Effective deployment of DHCP service requires careful consideration of the current
network architecture and device configurations. You can choose from several alterna-
tives when you move to DHCP. Probably the best choice is to use DHCP for all your
networked devices. If that strategy isn’t feasible, you can accommodate manually
configured devices by careful configuring your DHCP service. You can also benefit
from some of the advantages of DHCP in configuring legacy BOOTP devices by inte-
grating your DHCP and BOOTP services.
The choice of address lease lengths and the mobility patterns of your networked
devices have a significant effect on the behavior of DHCP clients and on the
computing resources that a DHCP server consumes. The essential trade-off is
between flexibility and processor load: Shorter leases decrease the delay in reclaim-
ing addresses and getting new configuration parameters to clients, at the expense of
CHAPTER 19 Tuning a DHCP Service334
023 3273 CH19 10/3/02 4:58 PM Page 334
increased load on the computer that is providing the DHCP service. There is no
single answer to the question “How long should my DHCP leases be?”; DHCP lease
lengths should be selected according to the structure of your network and the way in
which computers are used on your network. In fact, you might want to choose
different lease lengths for different parts of a network.
Summary 335
023 3273 CH19 10/3/02 4:58 PM Page 335