Vi. the messages captured during DHCP acquisition of IP addresses

DHCP is the application layer protocol, UDP is the Transport layer protocol, IP is the Network layer protocol, Ethernet is the link layer protocol. When data is transmitted over the network, it is packaged from top to bottom, and the typical DHCP process is this:
1: The client sends a DHCP_DISCOVER message to the server requesting IP.
2: The server returns the Dhcp_offer message to the client, specifying an IP to be assigned.
3: The client sends a DHCP_REQUEST message to the server requesting this IP.
4: The server ping several times (typically 3 times) This IP, if not received, it means that the IP is now idle, can be assigned to the client,
So send a dhcp_ack message to the client to confirm that it can be allocated. If appropriate, the DHCP_NAK message is sent and the assignment is denied.
5: If the client receives Dhcp_ack, it is responsible for sending a free ARP to determine if the IP has been used. Bind this service if it is not used
or send dhcp_decline messages to the server, rejecting this assignment. and re-execute the first step.
If you receive Dhcp_nak, the first step is re-executed directly.
Before the client requests IP, there is no ip,dhcp_discover message is sent in broadcast form, the destination address of IP header is 255.255.255.255, the source address is 0.0.0.0. The destination address of the link layer is FF-FF-FF-FF-FF-FF, and the source address is its own MAC address. When the server receives a discover message from the client, it sends a unicast Dhcp_offer message to the client based on the source MAC address.
Look at the DHCP messages that need to be crawled:
IP lease request message from customer
The DHCP client initializes TCP/IP and sends a DHCPDISCOVER broadcast packet to the network over UDP port 67, requesting the leased IP address. The source IP address in the broadcast packet is 0.0.0.0, the destination IP address is 255.255.255.255; The package also contains the MAC address and computer name of the client.

IP lease of DHCP response provides messages
Any DHCP server that receives a DHCPDISCOVER broadcast packet and can provide an IP address will respond to a DHCPOFFER broadcast packet to the client via UDP port 68, providing an IP address. The broadcast packet has a source IP address of DCHP server IP with a destination IP address of 255.255.255.255; The package also contains information such as the IP address, subnet mask, and lease period provided.

Customer chooses IP lease message
After the client receives the offer from more than one DHCP server, it selects the first received DHCPOFFER packet and broadcasts an DHCPREQUEST message packet to the network indicating that it has accepted the IP address provided by a DHCP server. The broadcast packet contains the IP address that is accepted and the IP address of the server. All other DHCP servers revoke their offer in order to provide IP addresses to the next IP lease request.

DHCP server sends IP lease acknowledgement message
When the DHCP server selected by the client receives the DHCPREQUEST broadcast, it broadcasts a DHCPACK message packet back to the client, indicating that the client's choice has been accepted and that the legitimate lease of this IP address and other configuration information are placed in the broadcast packet to the client.
Announcement messages issued after successful customer configuration
When the client receives the DHCPACK packet and uses the information in the broadcast packet to configure its own TCP/IP, the lease process is complete and the client can communicate on the network.
At this point a customer obtains IP DHCP service process basically end, but the customer obtains the IP generally is the lease period, needs to renew the lease period before the expiration, this process is through rents the update packet to complete.

Customer IP Lease Update message
(1) When the current lease period has passed 50%, the DHCP client sends DHCPREQUEST message packets directly to the DHCP server for which the IP address is provided. If the client receives the DHCPACK message packet that the server responds to, the client updates its configuration according to the new lease period provided in the package and other TCP/IP parameters that have been updated, and the lease update is complete. If a reply to the server is confiscated, the client continues to use the existing
IP address because the current lease period is still 50%.
(2) If the lease fails to update successfully at the last 50%, the client will again provide the DHCP contact with the IP address for the current lease at the last 87.5%. If the connection is unsuccessful, the IP lease process is restarted.
(3) If the DHCP client restarts, it will attempt to update the IP lease that was owned when the computer was last shut down. If the update does not succeed, the client will attempt to contact the default gateway listed in the existing IP lease. If the connection is successful and the lease has not yet expired, the client considers that it is still on the same subnet as it obtained the existing IP lease (not moved) and continues to use the existing IP address. If the failure to contact the default gateway succeeds, the client considers that it has been moved to a different subnet and will begin a new round of IP lease processes.

After the DHCP client has issued an IP lease request for the DHCPDISCOVER broadcast packet, it will take 1 seconds to wait for the DHCP server to respond, and if there is no response from the server for 1 seconds, it will re-broadcast the broadcast packet four times (in 2,4,8 and 16 second intervals, plus 1~ A random length of time between 1000 milliseconds). Four times, if you still fail to receive a response from the server, the DHCP client running Windows 2000 will choose an IP address from the 169.254.0.0/16 private IP address (APIPA). DHCP clients running other operating systems will not be able to obtain an IP address. DHCP clients still re-broadcast every 5 minutes, and if they receive a response from a server, the IP lease process continues.
For DHCP in the acquisition of IP address of the message, simple collation and interpretation, some of the data from the network, if there are errors Welcome to point out!

Vi. the messages captured during DHCP acquisition of IP addresses