DHCP: IT’S MOSTLY YELLING!!
summary
DHCP boots a host by broadcasting from 0.0.0.0 source, 255.255.255.255 dest and tracking conversations with a random transaction ID; the exchange is DHCP Discover→Offer→Request→Ack over UDP ports 67/68. TCPdump is used to inspect real packets and options reveal concrete configuration: subnet, gateway, DNS, NTP servers and option 252 (WPAD). Malicious or accidental DHCP replies can hand out bogus IPs, force a proxy or bad NTP and effectively break TLS; dnsmasq is an easy server to run for experiments.
AI-written summary · about
chapters (7)
- 0:00Start
- 1:19unicast IP address
- 2:35The solution: YELLING
- 4:32bootstrapping non-yelling!
- 5:19conversations when everyone's yelling
- 12:18what can go wrong?
- 12:53nobody's listening??
related talks
36mPeeling Away the Layers of the Network Stack
30mPackets, Protocols and PHP: Networking Fundamentals for Developers
40mPractice Safe Networking
22mWhy is it always DNS, TLS, and bad configs?
18mThe parts of DNS nobody explained to you
23mHoneypots 2.0: A New ‘Twist’ on Defending Enterprise Networks
45mAll the Ways to Control the Internet and More
38mCloud-Squatting: The Never-ending Misery Of Deleted & Forgotten Cloud Assets