Droms R. The DHCP handbook

Подождите немного. Документ загружается.

Some DHCP servers can assign a fixed IP address for a DHCP client on the client’s

home network and enable the client to acquire a dynamically assigned IP address if

it roams elsewhere.

Another fairly common strategy is to assign fixed addresses to registered DHCP

clients but enable unregistered DHCP clients to acquire dynamically assigned

addresses. This allows a user to get a specific IP address when he or she starts up the

computer but allows the network administrator to avoid keeping track of every

device that connects to the network.

Which of these strategies should be adopted at a particular site is a policy decision.

Obviously, keeping track of which DHCP clients are connected to the network is a

lot of work. However, in some environments it may be worth it.

NOTE

Not all servers support the same set of policies. Because DHCP does not specify what policies

must be supported, DHCP server implementers must choose how these policies are imple-

mented, and the choices they make might limit the range of possible policies. For example,

the Microsoft DHCP server supports a much more limited set of policies than does the ISC

DHCP server, even though both servers implement the same protocol.

You cannot use DHCP as a security mechanism. If a DHCP client elects not to follow

the protocol, a network administrator can do little, other than track down the

offending device and shut it off. A malicious user who wants to access the network

can always simply make up an IP address, send an ARP request for it, and then, if it

does not get an answer, use the fabricated address. Access control based on client

identification can be very convenient, but it does not prevent unauthorized access to

a network.

Summary

Every device that is attached to a network is configured with a unique address and

with other information about the network. Historically, an administrator or a knowl-

edgeable user manually configured each device. Addresses were allocated manually,

and reclaiming addresses required a great deal of knowledge—and the process was

still not very reliable.

BOOTP attempted to address this problem, but it fell short of a complete solution

because it solved only the problem of configuring systems, and not the problem of

allocating addresses.

CHAPTER 1 An Introduction to DHCP16

003 3273 CH01 10/3/02 5:01 PM Page 16

DHCP automates the entire process of configuring devices to use the network. A

properly configured network with a DHCP server can accommodate new devices

with little or no administrator intervention, and it requires no special knowledge on

the part of users.

You can configure DHCP in such a way that it is reliable and consumes few network

resources. Furthermore, DHCP servers can run on fairly inexpensive computers, and

it is so easy to set them up that it is cost-effective to do so on a very small network.

If you run any sort of IP network, then you will almost certainly use DHCP on

that network. DHCP can greatly simplify your work when you understand how it

functions.

Summary 17

003 3273 CH01 10/3/02 5:01 PM Page 17

003 3273 CH01 10/3/02 5:01 PM Page 18

IN THIS CHAPTER

• Setting Up the GSI Network

• Using DHCP to Configure

Computers

• Leases on IP Addresses in

DHCP

An Example of DHCP in

Operation

DHCP provides a mechanism through which a computer

can obtain an IP address and configuration parameters for

its network protocol software. The DHCP server allocates

an IP address and provides configuration information that

is appropriate for the network segment to which a DHCP

client computer is connected. As a way of introducing the

basic functions of DHCP, this chapter presents a case study

of an enterprise network that uses DHCP to automate the

configuration process.

Setting Up the GSI Network

This chapter uses an internal network for Generic Startup,

Inc. (GSI) as the basis for an introductory example of

DHCP operation. GSI’s roughly 100 employees are located

in a single building. Each employee has a computer

attached to the GSI network. The GSI data center includes

about 20 computers that provide file storage, printing,

DNS, DHCP, and related services. GSI also has a connection

to the Internet that is managed by the data center staff.

Figure 2.1 depicts the GSI network.

The network architect at GSI has organized the network

around five network segments, all connected to each other

through a single router. The router also connects the GSI

network to the Internet. Four of the network segments are

used by the staff desktop computers; the remaining

network segment is used for all of the data center comput-

ers. The GSI network architect has obtained five Class C IP

network addresses, 192.168.11.0 through 192.168.15.0, for

use on the GSI network and has assigned these addresses

to the network segments as shown in Figure 2.2.

004 3273 CH02 10/3/02 4:58 PM Page 19

CHAPTER 2 An Example of DHCP in Operation20

FIGURE 2.1 A diagram of the GSI network.

NOTE

The IP network addresses 192.168.11.0 through 192.168.15.0 are included in the block of

Class C network addresses reserved for private use in RFC 1918 and are used here only as an

example.

Internet

Router

Data Center

Staff

Internet

Router

192.168.11.0

192.168.12.0

192.168.13.0

192.168.14.0

192.168.15.0

FIGURE 2.2 IP addresses in the GSI network.

So, how is DHCP used in the GSI network? There is a computer running a DHCP

server on the 192.168.11.0 network. This DHCP server is configured to assign IP

addresses and manage the configurations of all the GSI network segments.

Computers attached to the GSI network contact the DHCP server to obtain an IP

address and other configuration information. The DHCP server is configured with a

description of the physical network architecture as well as the IP network address of

each network segment. Using this information, the server automatically selects

004 3273 CH02 10/3/02 4:58 PM Page 20

configuration information for each computer based on the network segment to

which the computer is attached. The DHCP server assigns an IP address to each

computer without requiring any manual intervention in the selection or tracking of

assigned addresses.

Using DHCP to Configure Computers

The DHCP server manages the configuration of computers attached to the GSI

network throughout their life cycle. This section describes the interactions between a

computer and the GSI DHCP server in the following instances:

•When the new computer is first connected to the GSI network.

•When the computer is restarted.

•When the computer is moved to a new location within GSI.

•When the computer is removed from use in GSI.

As shown in Figure 2.3, the GSI DHCP server,

dhcpserve, is connected to the data

center network segment, and a new computer,

desktop1, is attached to one of the

staff network segments.

Using DHCP to Configure Computers 21

Internet

Router

192.168.11.0

192.168.12.0

192.168.13.0

192.168.14.0

192.168.15.0

dhcpserve

desktop1

FIGURE 2.3 desktop1 and dhcpserve connected to the GSI network.

Using the DHCP Server to Obtain a New IP Address

When desktop1 is first connected to the GSI network, it needs to contact the DHCP

server to obtain an IP address and other configuration parameters. To locate a server,

desktop1 broadcasts a message to locate potential DHCP servers on the GSI network.

004 3273 CH02 10/3/02 4:58 PM Page 21

Then, dhcpserve receives this broadcast and replies to desktop1, identifying itself to

desktop1 as a DHCP server. Because desktop1 and dhcpserve are on different

network segments, the router, acting as a relay agent, forwards messages between the

two computers. Chapter 7, “Transmitting DHCP Messages,” discusses relay agents in

more detail. The interactions between

desktop1 and dhcpserve are discussed in the

following sections.

After receiving the initial message from

desktop1, dhcpserve selects an IP address,

192.168.12.25, which is appropriate for the 192.168.12.0 network to which

desktop1

is connected. dhcpserve also chooses other configuration parameters, such as the

subnet mask (255.255.255.0), the address of the router interface on the 192.168.12.0

network, and the address of the GSI DNS server.

dhcpserve uses the DHCP client

configuration rules defined by the network architect and information sent by the

relay agent to determine these parameters. It then returns an offer message that

contains the selected address and parameters to

desktop1.

After desktop1 receives the offer message from dhcpserve, it broadcasts a message

requesting the IP address and other configuration parameters from

dhcpserve. The

DHCP server confirms that the address is still available, and sends the parameters to

desktop1 in the final message of the sequence. When the message arrives, the DHCP

client software on

desktop1 extracts the configuration parameters from the message,

configures the client computer’s IP stack to use the IP address and any other parame-

ters it receives. As soon as the IP stack is configured, the client computer can use

network. The DHCP client software also records the IP address and configuration

parameters locally in a file on

desktop1 for later use.

A total of four messages are exchanged: two messages from the client and two replies

from the server. This sequence of messages may seem confusing and redundant at

first. Why would

desktop1 send back a request for the address and parameters that

dhcpserve returned in the first offer? The extra message exchange makes it possible

to have more than one DHCP server serving a network. Each server receives the

DHCP client’s initial message and sends a response. The DHCP client chooses one of

these responses. Each server whose response is not chosen reclaims the IP address it

offered. This issue is discussed in more detail in Chapter 8, “DHCP Message

Exchanges.”

Restarting desktop1

When

desktop1 is restarted (for example, when it is first turned on in the morning),

it retrieves the IP address and configuration parameters it previously received from

dhcpserve and attempts to reconfirm the configuration. As the next section explains,

reconfirming its configuration gives

desktop1 the opportunity to determine whether

that configuration is still valid. If

desktop1 is moved to a new network segment, it

must get a new IP address.

CHAPTER 2 An Example of DHCP in Operation22

004 3273 CH02 10/3/02 4:58 PM Page 22

For the moment, however, desktop1 is still attached to the 192.168.12.0 network.

When its confirmation message is received by

dhcpserve, the server sends back a

message indicating that

desktop1 can continue to use 192.168.12.25, and resends

the other configuration parameters that the client needs. After receiving the reply

message from

dhcpserve, desktop1 begins network activity.

Now, suppose that desktop1 fails to contact dhcpserve when it restarts. This could

occur if, for example, all the GSI computers are affected by a buildingwide power

outage and

desktop1 has completed its restart process before dhcpserve. If desktop1

receives no response to its reconfirmation message, it assumes that it is still

connected to the same network segment (192.168.12.0). At this point,

desktop1 has

no better information available, so it uses the IP address (192.167.12.25) and other

parameters previously assigned by

dhcpserve.

NOTE

As discussed later in this chapter, dhcpserve assigns an IP address to desktop1 for a limited

period of time called a lease. desktop1 tries to reconfirm its address and reuse its old IP

address only if that lease has not expired. If the lease has expired, desktop1 restarts the DHCP

process as though it had never been assigned an address.

Moving desktop1 to a New Network Segment

Now, consider what happens when desktop1 is moved to a new network segment.

When

desktop1 is started up in the new location and sends out a confirmation

request,

dhcpserve determines that its old IP address is not valid for use on the new

network segment. For example, if

desktop1 is moved to the segment with IP address

192.168.13.0, as Figure 2.4 illustrates,

dhcpserve receives a confirmation request

from

desktop1 to use its old address, 192.168.12.25, but it determines that the

message originated on network 192.168.13.0. Because the address sent by

desktop1 is

not a valid address for network 192.168.13.0,

dhcpserve determines that desktop1

has moved to a new segment.

When dhcpserve determines that desktop1 is connected to a different network

segment and that its IP address is no longer usable,

dhcpserve sends a response to

desktop1, denying use of its old address. After receiving the negative response,

desktop1 marks the IP address as invalid.

Using DHCP to Configure Computers 23

004 3273 CH02 10/3/02 4:58 PM Page 23

FIGURE 2.4 desktop1 connected to the 192.168.13.0 network segment.

Of course,

desktop1 still needs an IP address from its new network segment. At this

point, to obtain that address,

desktop1 uses the process described in the section

“Using the DHCP Server to Obtain a New IP Address”:

1. desktop1 broadcasts a request to obtain an address from a DHCP server.

2. dhcpserve selects an address from the 192.168.13.0 network and sends an offer

with the new address.

3. desktop1 requests the new address.

4. dhcpserve confirms the requested address and returns that address to desktop1.

In this case,

dhcpserve selects 192.168.13.37 from the 192.168.13.0 network to

allocate to

desktop1.

5. dhcpserve and desktop1 record the new address, and desktop1 begins to use

the new address immediately.

How does

dhcpserve determine the network segment to which desktop1 is attached?

As described in Chapter 7, when

desktop1 has not yet been configured with an

actual IP address, it sends its confirmation message with the source address field in

the IP datagram header set to 0.0.0.0. This means that

dhcpserve cannot deduce the

source of the message from the contents of the IP datagram header.

CHAPTER 2 An Example of DHCP in Operation24

Internet

Router

192.168.11.0

192.168.12.0

192.168.13.0

192.168.14.0

192.168.15.0

dhcpserve

desktop1

004 3273 CH02 10/3/02 4:58 PM Page 24

dhcpserve deduces the source of the message from desktop1 in one of two ways:

•Ifdesktop1 and dhcpserve are on two different network segments, a relay

agent must forward the message from

desktop1 to dhcpserve. The relay agent

includes information about the source of the message in the gateway address

field of the message from

desktop1 when it forwards the message to dhcpserve.

dhcpserve uses that information to determine to which segment desktop1 is

currently attached.

•If

dhcpserve receives a message with the gateway address field set to 0.0.0.0, it

knows that the relay agent did not forward the message and therefore

desktop1

and dhcpserve must be connected to the same subnet.

Retiring desktop1 from Service

As additional computers are connected to the 192.168.13.0 subnet, dhcpserve allo-

cates addresses to these new computers. Recall that 192.168.13.0 is a Class C IP

address. Thus, the 192.168.13.0 subnet has addresses for only 254 computers and,

eventually,

dhcpserve will run out of available addresses. DHCP allows for the reallo-

cation to new computers of addresses that are no longer in use. As computers are

removed from the 192.168.13.0 subnet,

dhcpserve makes those addresses available

for reallocation to new computers. As long as no more than 254 computers are

connected to the 192.168.13.0 subnet at any one time,

dhcpserve can allocate the

available addresses to those connected computers.

NOTE

Because the addresses 0 and 255 are reserved for network broadcasts and network number-

ing, a Class C network address has 254 distinct IP addresses for hosts.

Eventually, of course, desktop1 must go the way of all computers and be retired from

service at GSI. When

desktop1 is disconnected from the GSI network for the last

time, it does not send specific notification to

dhcpserve that it is being decommis-

sioned. Instead,

dhcpserve simply receives no further requests for confirmation or

for new addresses from

desktop1. After the lease on desktop1’s IP address has

expired, the DHCP server simply reclaims that IP address for use by some other

DHCP client. For

dhcpserve, the decommissioning of desktop1 is indistinguishable

from

desktop1 simply not being powered on.

Leases on IP Addresses in DHCP

When dhcpserve allocates an address, it specifies the length of time over which

the requesting computer may use that address. This time period is called a lease.

Leases on IP Addresses in DHCP 25

004 3273 CH02 10/3/02 4:58 PM Page 25