找回密码
 注册
查看: 4545|回复: 0

dhcp抓包分析

[复制链接]

1

主题

0

回帖

12

积分

管理员

积分
12
QQ
发表于 2017-9-19 19:09:20 | 显示全部楼层 |阅读模式
在axm上dump包,然后重启k2a(192.168.253.12),可以dump到dhcp(bootp)的包* d/ Z: n% `6 d4 E# W3 [- b: M' g8 n
  N& z# l2 H, Q/ q1 k( C/ e
toor@server:~# tcpdump -i k2a -ne   ##k2a是server端上连接client的接口
" U. O6 y- D8 R8 vtcpdump: WARNING: k2a: no IPv4 address assigned0 F1 H9 s0 B! ^5 P1 U
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode& ^0 Y5 t5 D( a( Y
listening on k2a, link-type EN10MB (Ethernet), capture size 65535 bytes+ x' Z1 d! u, J- O3 Q# i6 S- ]
04:25:16.517103 b4:99:4c:b8:6f:69(clinet MAC) > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 342:0.0.0.0.68 >255.255.255.255.67: BOOTP/DHCP, Request from b4:99:4c:b8:6f:69, length300 ##(见tcp/ip详解卷1,第16章). 68是client用端口,67是server用端口. client事先没有IP,所以client的bootp包中设置源ip是0.0.0.0* P1 v* a) L" F6 G  N  z8 a" L
04:25:16.517349 02:40:43:77:07:01(server MAC) > b4:99:4c:b8:6f:69, ethertype IPv4 (0x0800), length 342: 192.168.253.9.67 >192.168.253.12.68: BOOTP/DHCP, Reply, length 300 ## server端给client分配了IP为192.168.253.12,并reply给client端$ A+ |( A6 }0 q7 Z& z( \! B; {, ?
04:25:16.517613 b4:99:4c:b8:6f:69(client MAC) > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 64: Request who-has 192.168.253.9 tell 192.168.253.12, length 50  ##client要发送arp包得到server端MAC地址: i# L8 u( {8 {% @/ D' B. K4 M. b- j
04:25:16.517641 02:40:43:77:07:01 > b4:99:4c:b8:6f:69, ethertype ARP (0x0806), length 42: Reply 192.168.253.9 is-at 02:40:43:77:07:01, length 281 a# K% B: ]4 B+ W& s4 k; c% D
04:25:16.517751 b4:99:4c:b8:6f:69(client MAC) > 02:40:43:77:07:01(server MAC), ethertype IPv4 (0x0800), length 65: 192.168.253.12.1234 > 192.168.253.9.69:  23 RRQ "u-boot-eth.bin" octet ##client端发送TFTP请求从server段读取client所需的引导文件(下面block 1~355)
+ L( W$ b8 b/ p04:25:16.645200 02:40:43:77:07:01 > b4:99:4c:b8:6f:69, ethertype IPv4 (0x0800), length 558: 192.168.253.9.69 > 192.168.253.12.1234:  516 DATA block 1
* ^  M- n5 F4 p5 E04:25:16.645429 b4:99:4c:b8:6f:69 > 02:40:43:77:07:01, ethertype IPv4 (0x0800), length 64: 192.168.253.12.1234 > 192.168.253.9.69:  4 ACK block 1* i2 V0 r8 Q# t* [: p: f0 B3 i0 i
04:25:16.650059 02:40:43:77:07:01 > b4:99:4c:b8:6f:69, ethertype IPv4 (0x0800), length 558: 192.168.253.9.69 > 192.168.253.12.1234:  516 DATA block 26 A# c, F3 A. r: y- p8 x9 g
04:25:16.650281 b4:99:4c:b8:6f:69 > 02:40:43:77:07:01, ethertype IPv4 (0x0800), length 64: 192.168.253.12.1234 > 192.168.253.9.69:  4 ACK block 2  z0 ?, I& M& M# ^" C
04:25:16.653322 02:40:43:77:07:01 > b4:99:4c:b8:6f:69, ethertype IPv4 (0x0800), length 558: 192.168.253.9.69 > 192.168.253.12.1234:  516 DATA block 3; j; L4 i! H( _. o. j1 o" ^" {: r5 y
04:25:16.653543 b4:99:4c:b8:6f:69 > 02:40:43:77:07:01, ethertype IPv4 (0x0800), length 64: 192.168.253.12.1234 > 192.168.253.9.69:  4 ACK block 3
- G, R  E, V# E1 R  R... ...2 D; e* F( g/ u6 C/ J) N+ M" q
09:46:29.947034 02:40:43:77:07:01 > b4:99:4c:b8:6f:69, ethertype IPv4 (0x0800), length 558: 192.168.253.9.69 > 192.168.253.12.1234:  516 DATA block 352* i" ^5 t' F3 `
09:46:29.947241 b4:99:4c:b8:6f:69 > 02:40:43:77:07:01, ethertype IPv4 (0x0800), length 64: 192.168.253.12.1234 > 192.168.253.9.69:  4 ACK block 352) w1 W7 O+ k; [' ?8 V8 @9 B- l
09:46:29.947297 02:40:43:77:07:01 > b4:99:4c:b8:6f:69, ethertype IPv4 (0x0800), length 558: 192.168.253.9.69 > 192.168.253.12.1234:  516 DATA block 353
) {0 f6 M2 b2 f/ ]% I- M" S09:46:29.947504 b4:99:4c:b8:6f:69 > 02:40:43:77:07:01, ethertype IPv4 (0x0800), length 64: 192.168.253.12.1234 > 192.168.253.9.69:  4 ACK block 353
1 p" r8 ?  e! c6 w3 Y* U09:46:29.947552 02:40:43:77:07:01 > b4:99:4c:b8:6f:69, ethertype IPv4 (0x0800), length 558: 192.168.253.9.69 > 192.168.253.12.1234:  516 DATA block 354
. q% E1 C& i6 p# F4 e; m9 C09:46:29.947759 b4:99:4c:b8:6f:69 > 02:40:43:77:07:01, ethertype IPv4 (0x0800), length 64: 192.168.253.12.1234 > 192.168.253.9.69:  4 ACK block 354
# M% x$ U& [+ Y# t09:46:29.947825 02:40:43:77:07:01 > b4:99:4c:b8:6f:69, ethertype IPv4 (0x0800), length 277: 192.168.253.9.69 > 192.168.253.12.1234:  235 DATA block 355
9 D* q* Q# ?; J$ M6 t09:46:29.947997 b4:99:4c:b8:6f:69 > 02:40:43:77:07:01, ethertype IPv4 (0x0800), length 64: 192.168.253.12.1234 > 192.168.253.9.69:  4 ACK block 355
# d+ Y3 p0 t  `09:46:34.647872 b4:99:4c:b8:6f:69 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 303: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from b4:99:4c:b8:6f:69, length 2617 @- x4 F& U, s0 O# d5 |5 h: U
09:46:34.648098 02:40:43:77:07:01 > b4:99:4c:b8:6f:69, ethertype IPv4 (0x0800), length 342: 192.168.253.9.67 > 192.168.253.12.68: BOOTP/DHCP, Reply, length 300
1 V7 w1 c/ K) D/ m( Z1 N09:46:34.648213 b4:99:4c:b8:6f:69 > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 315: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from b4:99:4c:b8:6f:69, length 273( @% ]8 \2 d* D. K4 H9 c
09:46:34.649072 02:40:43:77:07:01 > b4:99:4c:b8:6f:69, ethertype IPv4 (0x0800), length 342: 192.168.253.9.67 > 192.168.253.12.68: BOOTP/DHCP, Reply, length 300
5 @0 W7 \* d% s' r# u09:46:34.947189 b4:99:4c:b8:6f:69 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Request who-has 192.168.253.9 tell 192.168.253.12, length 46
% ]3 G, }8 l0 C6 Z2 Q' n, g  K09:46:34.947215 02:40:43:77:07:01 > b4:99:4c:b8:6f:69, ethertype ARP (0x0806), length 42: Reply 192.168.253.9 is-at 02:40:43:77:07:01, length 28
; G% s1 _' y1 T5 c: b09:46:34.947360 b4:99:4c:b8:6f:69 > 02:40:43:77:07:01, ethertype IPv4 (0x0800), length 98: 192.168.253.12.1000 > 192.168.253.9.111: UDP, length 562 C8 k5 X, u% H  t. z1 {* K! ^6 ^
09:46:34.947512 02:40:43:77:07:01 > b4:99:4c:b8:6f:69, ethertype IPv4 (0x0800), length 70: 192.168.253.9.111 > 192.168.253.12.1000: UDP, length 285 A  z# B7 {2 w9 {  F( E$ e! }( e* b
09:46:34.947616 b4:99:4c:b8:6f:69 > 02:40:43:77:07:01, ethertype IPv4 (0x0800), length 98: 192.168.253.12.1000 > 192.168.253.9.111: UDP, length 56
) y: H+ n+ A) T) M* y09:46:34.947710 02:40:43:77:07:01 > b4:99:4c:b8:6f:69, ethertype IPv4 (0x0800), length 70: 192.168.253.9.111 > 192.168.253.12.1000: UDP, length 28( C* C" q- |# L  V6 K
09:46:34.947829 b4:99:4c:b8:6f:69 > 02:40:43:77:07:01, ethertype IPv4 (0x0800), length 122: 192.168.253.12.1000 > 192.168.253.9.48232: UDP, length 80+ Q5 ]7 L2 Y" ^/ N7 h: }
09:46:34.949267 02:40:43:77:07:01 > b4:99:4c:b8:6f:69, ethertype IPv4 (0x0800), length 102: 192.168.253.9.48232 > 192.168.253.12.1000: UDP, length 60! Q+ l8 w" G; ]( A
09:46:34.949408 b4:99:4c:b8:6f:69 > 02:40:43:77:07:01, ethertype IPv4 (0x0800), length 150: 192.168.253.12.4 > 192.168.253.9.2049: 108 lookup fh Unknown/0100010101000000C30000000000000000000000000000000000000000000000 "skern.bin"
7 x2 m! I6 C+ [# F09:46:34.949711 02:40:43:77:07:01 > b4:99:4c:b8:6f:69, ethertype IPv4 (0x0800), length 170: 192.168.253.9.2049 > 192.168.253.12.4: reply ok 128 lookup fh Unknown/0100010101000000B208000000000000000000000000000000000000000000001 i! ^. J6 i7 R
09:46:34.949835 b4:99:4c:b8:6f:69 > 02:40:43:77:07:01, ethertype IPv4 (0x0800), length 146: 192.168.253.12.5 > 192.168.253.9.2049: 104 read fh Unknown/0100010101000000B20800000000000000000000000000000000000000000000 1024 bytes @ 0+ z  x( D) V2 u( X& F, A4 B/ M2 K! V
$ u) z+ X4 A# G; K9 ~, P& f% p
server端dhcp配置文件:+ Z* K6 F# X: j/ o5 C' X, ~& L, @
/etc/dhcp/dhcpd.conf:) D7 K9 r: N1 B9 v) J& F
one-lease-per-client on;          # 每一个客户机对应一个租约信息
3 j# \( @5 g! {  jsubnet 192.168.253.8 netmask 255.255.255.248 {7 c  ^+ U6 V7 m6 H
    range dynamic-bootp 192.168.253.10 192.168.253.14;) y7 O  g* |0 Y0 }& O
   next-server 192.168.253.9;#设定存放初始启动文档的主机地址,The next-server statement is used to specify the host address of the server from which the initial boot file (specified in the filename statement) is to be loaded. Server-name should be a numeric IP address or a domain name. If no next-server statement applies to a given client, the address 0.0.0.0 is used.
8 N1 ?" `! m& t' X! Q- l    option subnet-mask 255.255.255.248;' f, E9 j+ j. Q; a1 \
    filename "u-boot-eth.bin";   ##下载启动文档的文件名,这个filename语句可以用来指定客户端启动要载入的初始启动文件,这个文件名应该是客户端能够识别的任何文件传送协议,可以用来传送那个文件。
& @* Z, \# w* M+ K( {, K/ F    option root-path "/squash/ks";/ q6 n4 ^7 q$ A6 H7 J$ L
    default-lease-time -1;         #无限租约时间
; g' t% N0 ?$ R& L3 S" V    max-lease-time -1;             #无限租约时间4 j% K, Q2 a1 p0 E( y
  }
8 j2 p  k( A; o( O7 R
9 L" s% H$ ^# R8 L6 R  o. N! m( iThe next-server directive is used to specify the IP address of the TFTP server., U  F" X9 h+ F  B. m9 ?$ A  s. ]$ F
The filename directive defines the path to /boot/pxeboot. A relative filename is used, meaning that /b/tftpboot is not included in the path., @! l3 f1 J/ A& [# T0 _
The root-path option defines the path to the NFS root file system.
+ K1 m' ~( {& r5 r
5 w& H  W9 c5 u0 C# [8 n" w' T9 W
您需要登录后才可以回帖 登录 | 注册

本版积分规则

返回首页|Archiver|手机版|小黑屋|易陆发现技术论坛 ( 蜀ICP备2026014127号-1 )

GMT+8, 2026-6-11 23:15 , Processed in 0.016058 second(s), 22 queries .

Powered by Discuz! X5.0

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表