1

The DHCP packets with the message type Discover, Offer, Request and Acknowledge use the L2 broadcast address for communication (even in the Acknowledge packet which has an IP destination of the newly leased address).

However, even when using Wireshark (in Promiscuous mode) the only broadcasts in my network I'm able to see are:

1 - The DHCP packets of my own host

2 - The Discover and the Request of other hosts, but not the Offer and the Ack of the DHCP server (in this case a router)

I am connected to a WEP2-Personal Wi-Fi using a Kali Linux machine and a sudo wireshark command with an interface in Promiscuous mode.

I want to understand why am I able to see the Discover and the Request packets of different hosts yet I can't see the response of the router that is also an L2 broadcast.

1 - Is it that the DHCP protocol has the ability to send an L2 unicast responding to hosts? but then why is the DORA process of my host fully in Broadcasts?

2 - Is it correct to imagine every host connected to the Wi-Fi as a host connected to the router with a cable, which then isolates every link as it's own broadcast domain? but why would I be able to see the Discover and Request of other hosts without the router's response?

3 - Is it possible that the issue is in Wireshark actually? and I'm unable to see packets that are not meant for my NIC? but then for the same reason why would I receive some broadcast without receiving others? unless that the logic behind choosing the packets meant for your NIC is beyond the IP and MAC addresses, and includes the "chaddr" in the BOOTP options (then the one deciding that this packet is not meant for my NIC is the application layer, BOOTP protocol in this case)

Thanks in advance for sharing your ideas and experiences.

5
  • 4
    Why do you think the Offer and Ack packets are broadcasted? They are normally unicast (using the MAC address of the requesting client and the IP address the server is offering), unless the client requests broadcast (through the first bit of the BOOTP flags).
    – Paul
    Jan 15 at 13:06
  • What is the general preference of the community when it comes to sharing data? a copy past of the whole packet and all of it's options extended or a screenshot is enough ? I can see in the full DORA process nothing but broadcasts
    – Strategist
    Jan 15 at 13:17
  • I would suggest a screenshot of the expanded packet (just the Offer would be enough for this discussion)
    – Paul
    Jan 15 at 13:23
  • Thanks Paul, I just checked and found out that the response in the Offer and Ack packets when I use dhclient to start the DORA process has the Broadcast flag activated. I've checked the Discover packet crafted by the dhclient tool and it includes option 28: Broadcast Address Option. Thanks for your help.
    – Strategist
    Jan 15 at 13:26
  • 1
    Normally, the server replies with unicast packets, unless the B broadcast flag is set by the requester. That is in the RFC: "To work around some clients that cannot accept IP unicast datagrams before the TCP/IP software is configured as discussed in the previous paragraph, DHCP uses the 'flags' field [21]. The leftmost bit is defined as the BROADCAST (B) flag."
    – Ron Maupin
    Jan 15 at 13:26

1 Answer 1

3

Is it that the DHCP protocol has the ability to send an L2 unicast responding to hosts?

Yes - DHCP uses UDP ports 67 (server) and 68 (client). Discover and Request are broadcast, Offer and Acknowledge are unicast. (Request may also be unicast for lease renewals.) In a switched network, unicast messages to other nodes are not visible - you need a NIC in promiscuous node and a monitoring port to see/capture them.

then why is the DORA process of my host fully in Broadcasts?

Perhaps you're able to capture the whole process since you're capturing from the client directly. Alternatively, servers reply by broadcast when requested by the client (B in the 'flags' field) - then that traffic is visible to all nodes.

Is it correct to imagine every host connected to the Wi-Fi as a host connected to the router with a cable, which then isolates every link as it's own broadcast domain?

The broadcast domain is the whole segment on the data link layer, ie. the full Wi-Fi SSID and possibly the bridged Ethernet segment. It's possible for the WAP or wireless router (or managed switch) to filter broadcast DHCP Discovery and Request messages, depending on its configuration.

but why would I be able to see the Discover and Request of other hosts without the router's response?

Discover and Request are broadcast, ie. copied to all nodes on the broadcast domain, and Offer and Ack are unicast, ie. forwarded only to their indicated destination.

See RFC 2131 for details.

6
  • I'm sure it isn't. - I'm not so sure; the RFC you refer to explicitly allows for a broadcast if requested by the client. If 'giaddr' is zero and 'ciaddr' is zero, and the broadcast bit is set, then the server broadcasts DHCPOFFER and DHCPACK messages to 0xffffffff.
    – Paul
    Jan 15 at 13:22
  • Agreed, but it's not common to broadcast the replies.
    – Zac67
    Jan 15 at 13:26
  • The initial Discovery packet had the option 28 (Broadcast Address Option) on, which forces the communication to be fully in broadcasts, which means that the other offers and Acks are actually unicasts. Thanks for everyone's help. How should I close the discussion please ?
    – Strategist
    Jan 15 at 13:28
  • @Strategist, if the answer helped you, that accept it (click the check mark by the vote in the margin) so that the question does not come up forever looking for an answer.
    – Ron Maupin
    Jan 15 at 13:33
  • sorry but it was Paul's comment under the post directly that provided the answer, should I write an answer where I add Paul as the one with the answer ? or should I just accept your answer and edit the main post so people can look directly in the comment section of the main question ?
    – Strategist
    Jan 15 at 13:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.