Droms R. The DHCP handbook

Подождите немного. Документ загружается.

APPENDIX F DHCP Server and Operating System Versions526

Thus, if you run a Windows-only site, you have at least one compelling reason to

run the Microsoft DHCP server. If you run a Unix-only site, or a site in which you

run central computing services from Unix machines, this may be a good reason to

choose the ISC DHCP server or another DHCP server that runs on Unix.

DHCP requires that the server know on what network interface a packet arrives and

determine on what interface a packet is sent. On operating systems that cannot

provide this capability, if more than one network interface is installed, the server

cannot operate correctly.

On some operating systems, the network application programming interface (API)

that enables the server to communicate on more than one network interface at a

time requires the application to perform link-layer packet framing. The ISC DHCP

server supports link-layer framing for FDDI, ethernet, and token ring.

Table F.1 shows a list of operating systems on which the ISC DHCP server runs, as

well as network hardware and configurations it supports on each operating system.

The Microsoft DHCP server runs only on Microsoft server operating systems, such as

Windows NT Server, Windows 2000 Server, and Windows XP Server, and it supports

multiple interfaces and all the network hardware types listed in Table F.1.

TABLE F.1 Operating Systems and Network Types Supported by the ISC DHCP Server

Target Operating ISC DHCP Multiple Token

System Server Interfaces Ring FDDI Ethernet

Windows 2000 Server

NetBSD ×××××

Linux ×××××

Solaris ×× ××

MacOS X ×× ××

FreeBSD ×× ××

BSD/OS ×× ××

Tru64 Unix ×× ××

AIX ××××

HP-UX ××××

User Interface

Another difference between the ISC DHCP server and the Microsoft DHCP server is

that the ISC DHCP server is configured through a human-readable text file, which

you can edit with a text editor, with automated shell scripts, or with both. The

Microsoft DHCP server is controlled entirely through a graphical user interface

(GUI), which enables you to view and update the server configuration in a conve-

nient hierarchical format but prevents you from modifying the server configuration

with any sort of automated script.

036 3273 App F 10/3/02 5:03 PM Page 526

This can actually be a key difference between the two servers. For a simple installa-

tion, it might be best to configure the DHCP server by using a GUI. For a more

complicated installation—or for an installation in which you are trying to do things

that weren’t envisioned by the people who designed the GUI—being able to directly

modify the server configuration with a program can be a big help.

Database Formats

The Microsoft and ISC DHCP servers use different database formats. The Microsoft

database is a binary database, which only Microsoft applications can read. The data-

base format is not documented, and Windows does not include a utility to dump the

contents of the database into a human-readable form or to load data into the data-

base.

The ISC DHCP server keeps its entire database in memory for quick access, and it

stores a log of all transactions on disk. The log is a human-readable text file, and the

last entry in the file for an IP address represents the current state of the lease on that

address. This database format has some major advantages: When the database is

loaded into memory, references and updates to it are quick. Because the on-disk log

is stored in a human-readable format, and because the format is documented, it’s

easy to directly examine the database to determine the state of a particular lease.

Writing shell or Perl scripts to automatically modify the database is also very easy.

The disadvantage of the ISC log-structured database is that the DHCP server must

parse the entire file when it starts up before it can begin answering requests, whereas

the Microsoft DHCP server’s binary file enables it to begin responding to requests

almost immediately after startup. Depending on the speed of the DHCP server

machine’s processor, it might take a site with 50,000 active leases several minutes to

load the lease database.

Support for BOOTP Clients

Some DHCP servers support only DHCP clients. For example, some versions of the

Microsoft DHCP server do not support BOOTP clients. For sites that still have BOOTP

clients deployed and want to serve both DHCP and BOOTP clients, using the same

server, the ISC DHCP server or a recent version of the Microsoft server are good

choices.

Serving both BOOTP and DHCP from the same server makes sense because BOOTP

and DHCP use UDP port 67 and share the same relay agent infrastructure. If you

want to use different BOOTP and DHCP server software, you must run BOOTP and

DHCP on two separate server machines. Also, DHCP/BOOTP relay agents must be

configured to send all packets to both DHCP and BOOTP servers because relay agents

generally don’t know the difference between DHCP and BOOTP packets. In addition

to generating an unwanted load on both servers, this configuration might also

double the amount of traffic the relay agent generates.

Choosing a DHCP Server 527

036 3273 App F 10/3/02 5:03 PM Page 527

ISC DHCP Server Operating System Dependencies

Because the ISC DHCP server runs on such a wide variety of operating systems, quite

a few system dependencies are specific to these operating systems, as discussed in the

following sections.

Problems with the 255.255.255.255 Broadcast Address

On almost every operating system in which the ISC DHCP distribution uses the BSD

socket API to send and receive packets on the network, a bug exists in the API that

prevents it from correctly sending packets to the 255.255.255.255 broadcast address.

Instead, the kernel uses the local subnet broadcast address. For example, on a subnet

with a subnet mask of 255.255.255.0 and a network number of 10.100.17.0, the

kernel substitutes the address 10.100.17.255 if the DHCP server specifies an IP desti-

nation address of 255.255.255.255.

This substitution of a different broadcast address is a problem because DHCP speci-

fies that when the DHCP server broadcasts a response to the DHCP client, it must

broadcast the response to the 255.255.255.255 broadcast address. Because the client

doesn’t know what network it is on, it has no way of knowing whether

10.100.17.255 is a host IP address or the broadcast address for the subnet. Many

DHCP clients ignore this, but unfortunately the Microsoft DHCP client does not. As

a result, the server receives

DHCPDISCOVER messages from the Microsoft client and

broadcasts responses, but the Microsoft client never hears the responses. The

Microsoft client continues broadcasting

DHCPDISCOVER messages until it gives up, and

as a result the client can’t use the network.

Fortunately, on most such operating systems, you can get around this problem by

installing a host route to the 255.255.255.255 address. You can also avoid this

problem in other ways, as described in the following sections, under the operating

systems on which the solutions were tried. However, if one solution does not work,

you might want to try the suggested solution for another operating system instead.

Linux Difficulties

To use the ISC DHCP distribution on Linux, you must use version 3.0 or later. In

addition, you must configure raw packet and Linux packet filter support into your

Linux kernel. If you do not, you get one of a variety of errors when you first start the

DHCP server, indicating that it can’t create a socket or bind to it. The error message

indicates that you must set

CONFIG_FILTER=y and CONFIG_PACKET=y in your Linux

kernel configuration file and rebuild the kernel.

In current versions of the kernel, you must link these capabilities into the kernel; if

you configure them as loadable modules, they are not loaded automatically. You can

force the modules to load on system startup, but it’s more reliable to just link them

into the kernel that you start up.

APPENDIX F DHCP Server and Operating System Versions528

036 3273 App F 10/3/02 5:03 PM Page 528

It is very easy to edit the kernel configuration and rebuild the kernel without actu-

ally ending up with the new kernel in the boot filesystem. Many users have gone

through this process and then concluded that the problem is not in the kernel. Every

time someone has reported this conclusion on the ISC DHCP mailing list, it has

turned out that they weren’t running the correct kernel. So if you continue to get

error messages like this, you haven’t correctly configured the kernel.

Some older versions of the Linux kernel (2.0.33 through 2.1) provide the capability

to use multiple network interfaces with the BSD socket API. This is actually preferable

to the Linux packet filter/raw packet API in many ways, but on some kernels, it is

necessary to configure a route to the broadcast address for this to work. With Linux,

the process for adding a route to the broadcast address varies, depending on the

version of the Linux

netutils package you are using. Example F.1 shows the easiest

method, which works on recent versions of

netutils.

Example F.1

% route add -host 255.255.255.255 dev eth0

If you are using more than one network interface, you must run this line for each

interface. Older versions of

netutils do not accept an address of 255.255.255.255 on

the command line because, as a signed 32-bit number, its value is -1, and that is the

same as the error code returned by the

inet_aton() function if it can’t convert the

address; therefore, the

route command assumes the address is bad. To work around

this, you can add an entry to your

/etc/hosts file for the all-ones IP address, as

shown in Example F.2.

Example F.2

255.255.255.255 all-ones

Next, you specify the hostname you used as the destination for the route command,

as shown in Example F.3.

Example F.3

% route add -host all-ones dev eth0

On some older versions of netutils, even this command doesn’t work. You can try

the command shown in Example F.4. It might work, but you should upgrade your

version of

netutils if you can.

Example F.4

% route add -net 255.255.255.0 dev eth0

ISC DHCP Server Operating System Dependencies 529

036 3273 App F 10/3/02 5:03 PM Page 529

Some versions of the Linux 2.1 kernel have a configuration parameter that you can

turn on and off to indicate whether the kernel should enable processes to act as

BOOTP agents. If this feature is not enabled, the DHCP server cannot run. If you

have trouble getting the server to work on a Linux 2.1 kernel, you might need to

enable this, as shown in Example F.5.

Example F.5

% echo 1 >/proc/sys/net/ipv4/ip_boot_agent

Versions of the Linux kernel prior to 2.0.33 do not support DHCP service on more

than one network interface. Even if you do not have more than one network inter-

face, you should upgrade your Linux kernel before running DHCP; later kernels are

known to work better with DHCP service in general.

HP-UX Difficulties

HP-UX has the broadcast address bug described earlier and can support only a single

network interface. On some versions of HP-UX, it might be possible to use the

route

commands suggested in the section on Linux. If these don’t work, another method

that is known to work on some versions of HP-UX is to modify the

/etc/rc.config.d/netconf file, as shown in Example F.6. (You must modify this to

suit your configuration; see the HP documentation for more information.)

Example F.6

INTERFACE_NAME[0]=lan0

IP_ADDRESS[0]=1.1.1.1

SUBNET_MASK[0]=255.255.255.0

BROADCAST_ADDRESS[0]=”255.255.255.255”

LANCONFIG_ARGS[0]=”ether”

DHCP_ENABLE[0]=0

Solaris Difficulties

Multiple-interface support on Solaris seems to be stable as of version 3.0. This

support uses the DLPI (Data Link Provider Interface) API, a low-level packet-driver

API. However, some problems were reported with using the DLPI API with some

network interface cards. If the DHCP server starts up with no errors but never seems

to receive any packets, you might have this problem. If you have only one network

interface, you can modify the

includes/site.h file by adding #define USE_SOCKETS,

and then type

make clean; make. The DHCP server that this builds uses the sockets

API instead of DLPI. Except for the restriction that the sockets API can be used with

only one network interface on Solaris, no known problems exist on Solaris when

using this API.

APPENDIX F DHCP Server and Operating System Versions530

036 3273 App F 10/3/02 5:03 PM Page 530

Glossary

Symbols and Numbers

/n Indicates a subnet mask or prefix length of n bits. See

also subnet mask.

6bone An experimental network testbed for IPv6.

address classes The definitions of the network

number and host identifier component of IP addresses.

Class A, B, and C addresses define unicast addresses,

Class D addresses are used for multicast, and Class E

addresses are reserved for future use.

address pool A set of IP addresses that are available for

assignment by a DHCP server to clients on a specific

network segment.

application layer The component of the TCP/IP proto-

col models that includes specific protocols used by applica-

tion programs.

ARP (Address Resolution Protocol) A protocol used

by TCP/IP hosts to resolve an IP address into a link-layer

address.

ARP cache timeout A setting that defines the lifetime

for entries in the ARP cache.

authentication In DHCP, the process of reliably identi-

fying a DHCP client or server to other DHCP participants

and of guaranteeing the integrity of DHCP messages.

automatic allocation The assignment of an IP address

with an infinite lease to a client by a DHCP server. See also

dynamic allocation, static allocation.

037 3273 App G 10/4/02 7:37 AM Page 531

APPENDIX G Glossary532

bootfile A file that contains additional information needed by a computer using

TCP/IP. For example, a bootfile can contain the operating system code for a computer

that has no local disk storage.

BOOTP (Bootstrap Protocol) A protocol that provides configuration informa-

tion to network devices through the network and, thus, eliminates the need for the

system administrator to manually configure each network device. BOOTP is a prede-

cessor of DHCP.

bridge A device that connects two network media so that they appear to the

attached computers as a single network segment.

broadcast A technique for delivering a network message to more than one desti-

nation. Many network technologies include the capability to broadcast a frame to all

the devices that are attached to a network segment.

broadcast flag A bit in the

flags field of a DHCP message that controls the use

of broadcast when a server or a relay agent is sending messages to a DHCP client.

cable modem network A networking technology that uses the coaxial cable

infrastructure used by cable TV to provide network connections to residences at

speeds up to several megabits per second.

Class A, B, and C addresses The three classes of IP addresses used for unicast

messages. See Chapter 4, “Configuring TCP/IP Stacks,” for the formats of these

addresses.

client An application, a computer, or another device that uses services provided

by other applications or computers, usually through a network.

client identifier A value chosen by a client to be used as its identifier by DHCP

servers. This value is used instead of the client’s link-layer address.

client/server model A paradigm for organizing distributed systems in which

applications contact a server to perform application-specific functions.

collision In DHCP, the use of the same client identifier by different DHCP clients.

colon-separated hexadecimal (colon hex) A textual representation of IPv6 IP

addresses in which groups of 16 bits are written in hexadecimal notation, separated

by colons. For example, 3FFE:C15:C001:F000:204:DDFF:FEBB:6642 is an IPv6 IP

address represented in colon hex notation.

037 3273 App G 10/4/02 7:37 AM Page 532

data link layer The component of the TCP/IP model that is responsible for deliv-

ering an IP datagram across a network segment to the next hop on the path to the

datagram’s destination.

datagram An IP protocol message.

default router (default route) A router used as the next hop to the destination

when there is no specific route in the IP routing table; some implementations specify

default routers as default route entries in the routing table.

dentist’s office Used as a shorthand or example of a small office with a local

network (origin unknown).

DHCP (Dynamic Host Configuration Protocol) A protocol that automates

the process of configuring network hosts by allowing hosts to obtain IP addresses

and configuration parameters through the network. DHCP eliminates the need for

manual configuration of hosts and manual assignment of IP addresses by network

administrators.

DHCP client A computer or another device that uses DHCP to obtain configura-

tion parameters.

DHCP client port UDP port 68, which is reserved for transmission of messages to

DHCP and BOOTP clients.

DHCP option A specific configuration parameter that is carried in the

variable-

format section of a DHCP message.

DHCP server An application program or a computer that provides configuration

parameters to DHCP clients.

DHCP server port UDP port 67, which is reserved for DHCP and BOOTP trans-

mission of messages to DHCP servers.

DHCPACK message A message that is transmitted by a DHCP server to a client to

confirm the use of the parameters requested by the client in a

DHCPREQUEST message.

DHCPDECLINE message A message that is transmitted by a DHCP client to a server

to decline an offered address because the client has determined that it is already in

use by another client.

DHCPDISCOVER message A message that is transmitted by a DHCP client to find

servers that are willing to offer an address and configuration parameters.

dhcpd.conf The configuration file that controls the operation of the ISC DHCP

server.

APPENDIX G Glossary 533

037 3273 App G 10/4/02 7:37 AM Page 533

dhcpd.leases The file in which the ISC DHCP server records information about

leases on addresses that are assigned to DHCP clients.

DHCPFORCERENEW message A message that is transmitted by a DHCP server to a

client to cause the client to send a

DHCPREQUEST message to the server. A DHCP-

FORCERENEW message is used to cause the client to request new parameters before its

current lease expires.

DHCPINFORM message A message that is used by a DHCP client that doesn’t need

an IP address to obtain other configuration parameters.

DHCPNAK

message A message that is transmitted by a DHCP server to a client to

inform the client that it cannot use the parameters requested by the client in a

DHCPREQUEST message.

DHCPOFFER message A message that is transmitted by a DHCP server in response to

DHCPDISCOVER requests to offer a client an address and configuration parameters.

DHCPRELEASE message A message that is transmitted by a DHCP client to a server

to explicitly terminate the lease on the client’s IP address prior to the expiration of

the lease.

DHCPREQUEST message A message that is used by a DHCP client to request initial

configuration parameters, to confirm the validity of an address already assigned to

the client, and to obtain an extension on the lease for an address assigned to the

client.

DHCPv6 A version of DHCP for IPv6.

DHCWG (Dynamic Host Configuration Working Group) The working

group of the IETF that is responsible for the development of DHCP.

DNS (Domain Name System) A service for translating names for Internet hosts

into IP addresses.

dotted decimal A notation for IP addresses in which each byte of the address is

written as a decimal number, separated by periods (“dots”). For example, 192.168.0.1

is an IP address represented in dotted-decimal notation.

dynamic allocation Assignment of an IP address to a DHCP client for a finite

period of time; the duration of the assignment is known as a lease. See also automatic

allocation, static allocation.

encapsulation The technique of carrying data within a protocol message; for

example, an IP datagram is encapsulated as the data area in an Ethernet frame.

Ethernet A network technology that carries data across a shared medium.

APPENDIX G Glossary534

037 3273 App G 10/4/02 7:37 AM Page 534

Ethernet encapsulation The specific format for transmitting an IP datagram in

an Ethernet frame. DHCP can use either Ethernet version 2 (RFC 894) or IEEE 802.3

(RFC 1042) encapsulation.

EUI-64 identifier A 64-bit unique identifier defined by IEEE. Assignment of EUI-

64 identifiers is managed by the IEEE Registration Authority.

expression In the

/etc/dhcp.conf file, a mathematical statement whose value is

derived from constants in the expression and by values extracted from the DHCP

packet, as specified in the expression. See Appendix B, “ISC DHCP Server

Configuration File Reference,” for examples of the use of expressions.

failover protocol A protocol used to provide synchronization between DHCP

servers that allows each server to provide service to DHCP clients if the other server

fails or becomes unreachable.

finite state machine A technique for describing the behavior of a system as a set

of states, transitions between states, and outputs.

firewall A device that is situated between an organization’s network and the

Internet that filters IP traffic to limit forwarding of unwanted IP datagrams.

fixed-format section The part of a DHCP message that has the same format in

every message. The fixed-format section is divided into several fields.

frame A packet that is transmitted across network hardware.

FTP (File Transfer Protocol) A service that includes an application-layer proto-

col for transferring files between computers.

hashed message authentication code A technique for generating a message

authentication code (MAC) based on a keyed message digest generator. See also MD5,

MAC.

hexadecimal A base-16 representation for integers.

host Any networked device that does not act like a router (that is, does not

forward IP datagrams).

host requirements documents (RFC 1121, RFC 1122, and RFC 1127)

Documents that provide summary and analysis of all the protocols in the TCP/IP

suite.

APPENDIX G Glossary 535

037 3273 App G 10/4/02 7:37 AM Page 535