(OK-HALF) To Find a Rogue DHCP Server—tcpdump/dhclient—nmap

最新推荐文章于 2022-07-26 11:34:17 发布
最新推荐文章于 2022-07-26 11:34:17 发布
阅读量780 收藏
点赞数
分类专栏： 网络安全
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/ztguang/article/details/51016451
版权

nmap -sP 10.108.160.0/22
tcpdump -i enp13s0 -nev  >> /tmp/rogue

++++++++++++++
Rogue DHCP Server MAC:  c8:3a:35:11:70:00

All mac addresses starting with C8-3A-35 belong to the owner Tenda Technology Co.,

++++++++++++++

tcpdump -i enp13s0 -nev udp port 68 >> /tmp/rogue 2>&1 &
arping -i eth1 00:E0:29:XX:YY:ZZ
nmap -sP 192.168.0.0/24 >/dev/null && arp -an | grep c8:3a:35:11:70:00 | awk '{print $2}' | sed 's/[()]//g'

++++++++++++++ Tenda MAC address list
Vendor: TendaTec Mac address: C8:3A:35

++++++++++++++ TP-Link MAC address list
Vendor: Tp-LinkT Mac address: 00:19:E0
Vendor: Tp-LinkT Mac address: 00:1D:0F
Vendor: Tp-LinkT Mac address: 00:21:27
Vendor: Tp-LinkT Mac address: 00:23:CD
Vendor: Tp-LinkT Mac address: 00:25:86
Vendor: Tp-LinkT Mac address: 00:27:19
Vendor: Tp-LinkT Mac address: 40:16:9F
Vendor: Tp-LinkT Mac address: 54:E6:FC
Vendor: Tp-LinkT Mac address: 74:EA:3A
Vendor: Tp-LinkT Mac address: 94:0C:6D
Vendor: Tp-LinkT Mac address: B0:48:7A
Vendor: Tp-LinkT Mac address: D8:5D:4C
Vendor: Tp-LinkT Mac address: E0:05:C5
Vendor: Tp-LinkT Mac address: F4:EC:38


++++++++++++++++++++++++++++

+++++++++++++++++++异常

[root@localhost core]# tcpdump -i enp13s0 -nev udp port 68

tcpdump: listening on enp13s0, link-type EN10MB (Ethernet), capture size 65535 bytes
08:56:13.405651 3c:97:0e:f0:b5:bb > c8:3a:35:11:70:00, ethertype IPv4 (0x0800), length 342: (tos 0x0, ttl 64, id 56976, offset 0, flags [DF], proto UDP (17), length 328)
    192.168.0.111.bootpc > 192.168.0.1.bootps: BOOTP/DHCP, Request from 3c:97:0e:f0:b5:bb, length 300, xid 0x292e3d42, Flags [none]
      Client-IP 192.168.0.111
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Release
        Server-ID Option 54, length 4: 192.168.0.1
08:56:23.516772 3c:97:0e:f0:b5:bb > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0x10, ttl 128, id 0, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 3c:97:0e:f0:b5:bb, length 300, xid 0xb5d8ea1c, Flags [none]
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Discover
        Requested-IP Option 50, length 4: 192.168.0.111
        Parameter-Request Option 55, length 13:
          Subnet-Mask, BR, Time-Zone, Classless-Static-Route
          Domain-Name, Domain-Name-Server, Hostname, YD
          YS, NTP, MTU, Option 119
          Default-Gateway
08:56:23.526530 c8:3a:35:11:70:00 > 3c:97:0e:f0:b5:bb, ethertype IPv4 (0x0800), length 590: (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto UDP (17), length 576)
    192.168.0.1.bootps > 192.168.0.111.bootpc: BOOTP/DHCP, Reply, length 548, xid 0xb5d8ea1c, Flags [none]
      Your-IP 192.168.0.111
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Offer
        Server-ID Option 54, length 4: 192.168.0.1
        Lease-Time Option 51, length 4: 86400
        Subnet-Mask Option 1, length 4: 255.255.255.0
        Default-Gateway Option 3, length 4: 192.168.0.1
        Domain-Name-Server Option 6, length 8: 192.168.0.1,192.168.0.1
        MTU Option 26, length 2: 1500
08:56:23.526667 3c:97:0e:f0:b5:bb > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0x10, ttl 128, id 0, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 3c:97:0e:f0:b5:bb, length 300, xid 0xb5d8ea1c, Flags [none]
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Request
        Server-ID Option 54, length 4: 192.168.0.1
        Requested-IP Option 50, length 4: 192.168.0.111
        Parameter-Request Option 55, length 13:
          Subnet-Mask, BR, Time-Zone, Classless-Static-Route
          Domain-Name, Domain-Name-Server, Hostname, YD
          YS, NTP, MTU, Option 119
          Default-Gateway
08:56:23.536296 00:0f:e2:6a:09:78 > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0xe0, ttl 255, id 12000, offset 0, flags [none], proto UDP (17), length 328)
    10.108.160.1.bootps > 255.255.255.255.bootpc: BOOTP/DHCP, Reply, length 300, hops 1, xid 0xb5d8ea1c, Flags [Broadcast]
      Gateway-IP 10.108.160.1
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: NACK
        Server-ID Option 54, length 4: 10.3.9.2
        MSG Option 56, length 31: "requested address not available"
08:56:23.537153 00:0f:e2:6a:09:78 > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0xe0, ttl 255, id 12001, offset 0, flags [none], proto UDP (17), length 328)
    10.108.160.1.bootps > 255.255.255.255.bootpc: BOOTP/DHCP, Reply, length 300, hops 1, xid 0xb5d8ea1c, Flags [Broadcast]
      Gateway-IP 10.108.160.1
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: NACK
        Server-ID Option 54, length 4: 10.3.9.31
        MSG Option 56, length 31: "requested address not available"
08:56:23.550490 c8:3a:35:11:70:00 > 3c:97:0e:f0:b5:bb, ethertype IPv4 (0x0800), length 590: (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto UDP (17), length 576)
    192.168.0.1.bootps > 192.168.0.111.bootpc: BOOTP/DHCP, Reply, length 548, xid 0xb5d8ea1c, Flags [none]
      Your-IP 192.168.0.111
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: ACK
        Server-ID Option 54, length 4: 192.168.0.1
        Lease-Time Option 51, length 4: 86400
        Subnet-Mask Option 1, length 4: 255.255.255.0
        Default-Gateway Option 3, length 4: 192.168.0.1
        Domain-Name-Server Option 6, length 8: 192.168.0.1,192.168.0.1
        MTU Option 26, length 2: 1500
08:56:23.961106 3c:97:0e:f0:b5:bb > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0x10, ttl 128, id 0, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 3c:97:0e:f0:b5:bb, length 300, xid 0x2bdda24d, Flags [none]
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Discover
        Parameter-Request Option 55, length 13:
          Subnet-Mask, BR, Time-Zone, Classless-Static-Route
          Domain-Name, Domain-Name-Server, Hostname, YD
          YS, NTP, MTU, Option 119
          Default-Gateway
08:56:23.970519 c8:3a:35:11:70:00 > 3c:97:0e:f0:b5:bb, ethertype IPv4 (0x0800), length 590: (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto UDP (17), length 576)
    192.168.0.1.bootps > 192.168.0.111.bootpc: BOOTP/DHCP, Reply, length 548, xid 0x2bdda24d, Flags [none]
      Your-IP 192.168.0.111
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Offer
        Server-ID Option 54, length 4: 192.168.0.1
        Lease-Time Option 51, length 4: 86400
        Subnet-Mask Option 1, length 4: 255.255.255.0
        Default-Gateway Option 3, length 4: 192.168.0.1
        Domain-Name-Server Option 6, length 8: 192.168.0.1,192.168.0.1
        MTU Option 26, length 2: 1500
08:56:23.970708 3c:97:0e:f0:b5:bb > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0x10, ttl 128, id 0, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 3c:97:0e:f0:b5:bb, length 300, xid 0x2bdda24d, Flags [none]
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Request
        Server-ID Option 54, length 4: 192.168.0.1
        Requested-IP Option 50, length 4: 192.168.0.111
        Parameter-Request Option 55, length 13:
          Subnet-Mask, BR, Time-Zone, Classless-Static-Route
          Domain-Name, Domain-Name-Server, Hostname, YD
          YS, NTP, MTU, Option 119
          Default-Gateway
08:56:23.979893 00:0f:e2:6a:09:78 > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0xe0, ttl 255, id 12006, offset 0, flags [none], proto UDP (17), length 328)
    10.108.160.1.bootps > 255.255.255.255.bootpc: BOOTP/DHCP, Reply, length 300, hops 1, xid 0x2bdda24d, Flags [Broadcast]
      Gateway-IP 10.108.160.1
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: NACK
        Server-ID Option 54, length 4: 10.3.9.31
        MSG Option 56, length 31: "requested address not available"
08:56:23.980828 00:0f:e2:6a:09:78 > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0xe0, ttl 255, id 12007, offset 0, flags [none], proto UDP (17), length 328)
    10.108.160.1.bootps > 255.255.255.255.bootpc: BOOTP/DHCP, Reply, length 300, hops 1, xid 0x2bdda24d, Flags [Broadcast]
      Gateway-IP 10.108.160.1
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: NACK
        Server-ID Option 54, length 4: 10.3.9.2
        MSG Option 56, length 31: "requested address not available"
08:56:23.994474 c8:3a:35:11:70:00 > 3c:97:0e:f0:b5:bb, ethertype IPv4 (0x0800), length 590: (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto UDP (17), length 576)
    192.168.0.1.bootps > 192.168.0.111.bootpc: BOOTP/DHCP, Reply, length 548, xid 0x2bdda24d, Flags [none]
      Your-IP 192.168.0.111
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: ACK
        Server-ID Option 54, length 4: 192.168.0.1
        Lease-Time Option 51, length 4: 86400
        Subnet-Mask Option 1, length 4: 255.255.255.0
        Default-Gateway Option 3, length 4: 192.168.0.1
        Domain-Name-Server Option 6, length 8: 192.168.0.1,192.168.0.1
        MTU Option 26, length 2: 1500
08:56:24.525846 00:0f:e2:6a:09:78 > 3c:97:0e:f0:b5:bb, ethertype IPv4 (0x0800), length 349: (tos 0xe0, ttl 255, id 12032, offset 0, flags [none], proto UDP (17), length 335)
    10.108.160.1.bootps > 10.108.162.164.bootpc: BOOTP/DHCP, Reply, length 307, hops 1, xid 0xb5d8ea1c, Flags [none]
      Your-IP 10.108.162.164
      Gateway-IP 10.108.160.1
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Offer
        Server-ID Option 54, length 4: 10.3.9.2
        Lease-Time Option 51, length 4: 6878
        Subnet-Mask Option 1, length 4: 255.255.252.0
        BR Option 28, length 4: 10.108.163.255
        Domain-Name Option 15, length 11: "bupt.edu.cn"
        Domain-Name-Server Option 6, length 12: 10.3.9.4,10.3.9.5,10.3.9.6
        NTP Option 42, length 4: 10.3.9.9
        Default-Gateway Option 3, length 4: 10.108.160.1

+++++++++++++++++++++++++++++++
[root@localhost core]# tcpdump -i enp13s0 -nev udp port 68 >> /tmp/rogue 2>&1 &
[root@localhost core]# cat /tmp/rogue
[root@localhost core]# tcpdump -i enp13s0 -nev udp port 68

tcpdump: WARNING: enp13s0: no IPv4 address assigned
tcpdump: listening on enp13s0, link-type EN10MB (Ethernet), capture size 65535 bytes
08:57:50.318066 74:27:ea:ac:07:52 > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0x0, ttl 64, id 9019, offset 0, flags [none], proto UDP (17), length 328)
    10.108.163.64.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 74:27:ea:ac:07:52, length 300, xid 0x460dbace, Flags [none]
      Client-IP 10.108.163.64
      Client-Ethernet-Address 74:27:ea:ac:07:52
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Inform
        Client-ID Option 61, length 7: ether 74:27:ea:ac:07:52
        Hostname Option 12, length 12: "xiaoyifei-PC"
        Vendor-Class Option 60, length 8: "MSFT 5.0"
        Parameter-Request Option 55, length 13:
          Subnet-Mask, Domain-Name, Default-Gateway, Domain-Name-Server
          Netbios-Name-Server, Netbios-Node, Netbios-Scope, Router-Discovery
          Static-Route, Classless-Static-Route, Classless-Static-Route-Microsoft, Vendor-Option
          Option 252
08:57:50.733654 3c:97:0e:f0:b5:bb > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0x10, ttl 128, id 0, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 3c:97:0e:f0:b5:bb, length 300, xid 0xbdc7c05e, Flags [none]
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Discover
        Requested-IP Option 50, length 4: 192.168.0.111
        Parameter-Request Option 55, length 13:
          Subnet-Mask, BR, Time-Zone, Classless-Static-Route
          Domain-Name, Domain-Name-Server, Hostname, YD
          YS, NTP, MTU, Option 119
          Default-Gateway
08:57:50.742946 c8:3a:35:11:70:00 > 3c:97:0e:f0:b5:bb, ethertype IPv4 (0x0800), length 590: (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto UDP (17), length 576)
    192.168.0.1.bootps > 192.168.0.111.bootpc: BOOTP/DHCP, Reply, length 548, xid 0xbdc7c05e, Flags [none]
      Your-IP 192.168.0.111
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Offer
        Server-ID Option 54, length 4: 192.168.0.1
        Lease-Time Option 51, length 4: 86400
        Subnet-Mask Option 1, length 4: 255.255.255.0
        Default-Gateway Option 3, length 4: 192.168.0.1
        Domain-Name-Server Option 6, length 8: 192.168.0.1,192.168.0.1
        MTU Option 26, length 2: 1500
08:57:50.743076 3c:97:0e:f0:b5:bb > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0x10, ttl 128, id 0, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 3c:97:0e:f0:b5:bb, length 300, xid 0xbdc7c05e, Flags [none]
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Request
        Server-ID Option 54, length 4: 192.168.0.1
        Requested-IP Option 50, length 4: 192.168.0.111
        Parameter-Request Option 55, length 13:
          Subnet-Mask, BR, Time-Zone, Classless-Static-Route
          Domain-Name, Domain-Name-Server, Hostname, YD
          YS, NTP, MTU, Option 119
          Default-Gateway
08:57:50.766898 c8:3a:35:11:70:00 > 3c:97:0e:f0:b5:bb, ethertype IPv4 (0x0800), length 590: (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto UDP (17), length 576)
    192.168.0.1.bootps > 192.168.0.111.bootpc: BOOTP/DHCP, Reply, length 548, xid 0xbdc7c05e, Flags [none]
      Your-IP 192.168.0.111
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: ACK
        Server-ID Option 54, length 4: 192.168.0.1
        Lease-Time Option 51, length 4: 86400
        Subnet-Mask Option 1, length 4: 255.255.255.0
        Default-Gateway Option 3, length 4: 192.168.0.1
        Domain-Name-Server Option 6, length 8: 192.168.0.1,192.168.0.1
        MTU Option 26, length 2: 1500
08:57:50.773417 00:0f:e2:6a:09:78 > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0xe0, ttl 255, id 14201, offset 0, flags [none], proto UDP (17), length 328)
    10.108.160.1.bootps > 255.255.255.255.bootpc: BOOTP/DHCP, Reply, length 300, hops 1, xid 0xbdc7c05e, Flags [Broadcast]
      Gateway-IP 10.108.160.1
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: NACK
        Server-ID Option 54, length 4: 10.3.9.31
        MSG Option 56, length 31: "requested address not available"
08:57:50.774332 00:0f:e2:6a:09:78 > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0xe0, ttl 255, id 14202, offset 0, flags [none], proto UDP (17), length 328)
    10.108.160.1.bootps > 255.255.255.255.bootpc: BOOTP/DHCP, Reply, length 300, hops 1, xid 0xbdc7c05e, Flags [Broadcast]
      Gateway-IP 10.108.160.1
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: NACK
        Server-ID Option 54, length 4: 10.3.9.2
        MSG Option 56, length 31: "requested address not available"
08:57:51.745699 00:0f:e2:6a:09:78 > 3c:97:0e:f0:b5:bb, ethertype IPv4 (0x0800), length 349: (tos 0xe0, ttl 255, id 14219, offset 0, flags [none], proto UDP (17), length 335)
    10.108.160.1.bootps > 10.108.162.164.bootpc: BOOTP/DHCP, Reply, length 307, hops 1, xid 0xbdc7c05e, Flags [none]
      Your-IP 10.108.162.164
      Gateway-IP 10.108.160.1
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Offer
        Server-ID Option 54, length 4: 10.3.9.2
        Lease-Time Option 51, length 4: 6791
        Subnet-Mask Option 1, length 4: 255.255.252.0
        BR Option 28, length 4: 10.108.163.255
        Domain-Name Option 15, length 11: "bupt.edu.cn"
        Domain-Name-Server Option 6, length 12: 10.3.9.4,10.3.9.5,10.3.9.6
        NTP Option 42, length 4: 10.3.9.9
        Default-Gateway Option 3, length 4: 10.108.160.1
08:57:58.891406 3c:97:0e:a6:bf:95 > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0x0, ttl 64, id 22516, offset 0, flags [none], proto UDP (17), length 328)
    10.108.162.31.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 3c:97:0e:a6:bf:95, length 300, xid 0x34f84154, Flags [none]
      Client-IP 10.108.162.31
      Client-Ethernet-Address 3c:97:0e:a6:bf:95
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Inform
        Client-ID Option 61, length 7: ether 3c:97:0e:a6:bf:95
        Hostname Option 12, length 3: "ytx"
        Vendor-Class Option 60, length 8: "MSFT 5.0"
        Parameter-Request Option 55, length 13:
          Subnet-Mask, Domain-Name, Default-Gateway, Domain-Name-Server
          Netbios-Name-Server, Netbios-Node, Netbios-Scope, Router-Discovery
          Static-Route, Classless-Static-Route, Classless-Static-Route-Microsoft, Vendor-Option
          Option 252

++++++++++++++++++++正常

[root@localhost core]# cat /tmp/rogue
tcpdump: listening on enp13s0, link-type EN10MB (Ethernet), capture size 65535 bytes
09:03:31.867877 3c:97:0e:f0:b5:bb > 00:0f:e2:6a:09:78, ethertype IPv4 (0x0800), length 342: (tos 0x0, ttl 64, id 32929, offset 0, flags [DF], proto UDP (17), length 328)
    10.108.162.164.bootpc > 192.168.0.1.bootps: BOOTP/DHCP, Request from 3c:97:0e:f0:b5:bb, length 300, xid 0x4d825b75, Flags [none]
      Client-IP 192.168.0.111
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Release
        Server-ID Option 54, length 4: 192.168.0.1
09:03:35.721679 3c:97:0e:f0:b5:bb > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0x10, ttl 128, id 0, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 3c:97:0e:f0:b5:bb, length 300, xid 0xf7a09f4e, Flags [none]
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Discover
        Requested-IP Option 50, length 4: 192.168.0.111
        Parameter-Request Option 55, length 13:
          Subnet-Mask, BR, Time-Zone, Classless-Static-Route
          Domain-Name, Domain-Name-Server, Hostname, YD
          YS, NTP, MTU, Option 119
          Default-Gateway
09:03:36.730560 00:0f:e2:6a:09:78 > 3c:97:0e:f0:b5:bb, ethertype IPv4 (0x0800), length 349: (tos 0xe0, ttl 255, id 23033, offset 0, flags [none], proto UDP (17), length 335)
    10.108.160.1.bootps > 10.108.162.164.bootpc: BOOTP/DHCP, Reply, length 307, hops 1, xid 0xf7a09f4e, Flags [none]
      Your-IP 10.108.162.164
      Gateway-IP 10.108.160.1
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Offer
        Server-ID Option 54, length 4: 10.3.9.2
        Lease-Time Option 51, length 4: 6446
        Subnet-Mask Option 1, length 4: 255.255.252.0
        BR Option 28, length 4: 10.108.163.255
        Domain-Name Option 15, length 11: "bupt.edu.cn"
        Domain-Name-Server Option 6, length 12: 10.3.9.4,10.3.9.5,10.3.9.6
        NTP Option 42, length 4: 10.3.9.9
        Default-Gateway Option 3, length 4: 10.108.160.1
09:03:36.730688 3c:97:0e:f0:b5:bb > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0x10, ttl 128, id 0, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 3c:97:0e:f0:b5:bb, length 300, xid 0xf7a09f4e, Flags [none]
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Request
        Server-ID Option 54, length 4: 10.3.9.2
        Requested-IP Option 50, length 4: 10.108.162.164
        Parameter-Request Option 55, length 13:
          Subnet-Mask, BR, Time-Zone, Classless-Static-Route
          Domain-Name, Domain-Name-Server, Hostname, YD
          YS, NTP, MTU, Option 119
          Default-Gateway
09:03:36.741608 00:0f:e2:6a:09:78 > 3c:97:0e:f0:b5:bb, ethertype IPv4 (0x0800), length 349: (tos 0xe0, ttl 255, id 23037, offset 0, flags [none], proto UDP (17), length 335)
    10.108.160.1.bootps > 10.108.162.164.bootpc: BOOTP/DHCP, Reply, length 307, hops 1, xid 0xf7a09f4e, Flags [none]
      Your-IP 10.108.162.164
      Gateway-IP 10.108.160.1
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: ACK
        Server-ID Option 54, length 4: 10.3.9.2
        Lease-Time Option 51, length 4: 6445
        Subnet-Mask Option 1, length 4: 255.255.252.0
        BR Option 28, length 4: 10.108.163.255
        Domain-Name Option 15, length 11: "bupt.edu.cn"
        Domain-Name-Server Option 6, length 12: 10.3.9.4,10.3.9.5,10.3.9.6
        NTP Option 42, length 4: 10.3.9.9
        Default-Gateway Option 3, length 4: 10.108.160.1
09:03:36.742581 00:0f:e2:6a:09:78 > 3c:97:0e:f0:b5:bb, ethertype IPv4 (0x0800), length 349: (tos 0xe0, ttl 255, id 23038, offset 0, flags [none], proto UDP (17), length 335)
    10.108.160.1.bootps > 10.108.162.164.bootpc: BOOTP/DHCP, Reply, length 307, hops 1, xid 0xf7a09f4e, Flags [none]
      Your-IP 10.108.162.164
      Gatew[root@localhost core]#

<script>window._bd_share_config={"common":{"bdSnsKey":{},"bdText":"","bdMini":"2","bdMiniList":false,"bdPic":"","bdStyle":"0","bdSize":"16"},"share":{}};with(document)0[(getElementsByTagName('head')[0]||body).appendChild(createElement('script')).src='http://bdimg.share.baidu.com/static/api/js/share.js?v=89860593.js?cdnversion='+~(-new Date()/36e5)];</script>
阅读(163) | 评论(0) | 转发(0) |
0

上一篇：IMUNES—Integrated Multiprotocol Network Emulator/Simulator

下一篇：FreeBSD 10.1 64位操作系统安装图解

相关热门文章
给主人留下些什么吧！~~
评论热议
ztguang
关注
  • 0
    点赞
  • 踩
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
专栏目录
Rogue DHCP Server攻击（仿冒DHCP Server攻击）
墨痕诉清风的博客
07-12 455
为了防止仿冒的DHCP Server攻击，可以设置交换机的“信任/非信任”的工作模式。将与合法DHCP服务器直接或间接连接的接口设置为信任接口，其他接口设置为非信任接口。此后，从“非信任（Untrusted）”接口上收到的DHCP回应报文将被直接丢弃，这样可以有效防止DHCP Server仿冒者的攻击。由于DHCP Server和DHCP Client之间没有认证机制，所以如果在网络上随意添加一台DHCP服务器，它就可以为客户端分配IP地址以及其他网络参数。当终端开启DHCP服务时，kali便能开始嗅探。
Microsoft Rogue DHCP Server Checker
07-21
Microsoft 自家出品的 Rogue DHCP Server Checker，在官网上已不可下载，但在 Windows Server 2003-2022，及客户端上皆可使用。使用很简单，直接运行即可。参考文档：...
DHCP原理与配置
weixin_71429850的博客
07-20 1609
Protocol,动态主机配置协议）是由Internet工作任务小组设计开发的，专门用于为TCP/IP网络中的计算机自动分配TCP/IP参数的协议，是一个应用层协议，使用UDP的67和68端口。DHCP的前身是BOOTP协议(BootstrapProtocol),BOOTP被创建出来为连接到网络中的设备自动分配地址，后来被DHCP取代了，DHCP比BOOTP更加复杂，功能更强大。...
Tcpdump命令详解
qq_57377057的博客
07-26 4万+
Linux作为网络服务器，特别是作为路由器和网关时，数据的采集和分析是不可少的。TcpDump是Linux中强大的网络数据采集分析工具之一。tcpdump可以根据使用者需求对网络上传输的数据包进行捕获的抓包工具，windows平台有wireshark等工具，tcpdump可以将网络中传输的数据包的“包头”全部捕获过来进行分析，其支持网络层、特定的传输协议、数据发送和接收的主机、网卡和端口的过滤，并提供and、or、not等语句进行逻辑组合捕获数据包或去掉不用的信息。......
【排错】故障处理思路客户端通过DHCP获取不到地址
weixin_46532751的博客
12-08 7023
排错精髓 确定拓扑 根据拓扑确定功能 确定思路（自上而下、自下而上） 展开分析 定界——定位——定因 故障处理思路客户端通过DHCP获取不到地址 客户端无法获取完整的IP地址（思考顺序） pc终端或者操作系统问题 环境问题（环路或者攻击） 配置错误或者不合理 DHCP server服务器性能不足 排查思路 1、排查客户端以及操作系统问题 确认故障是单台客户端还是大面积客户端都无法获取地址 span功能 配置镜像源或者是端口vlan 若只有一台pc出现问题，可以在pc端安装抓包软件，通过查看客户端
tcpdump命令详解
热门推荐
wj31932的博客
06-05 10万+
本文介绍tcpdump的命令常用格式，参数详解和常见用法技巧范例，并有解决具体问题的实例。是全网最好的入门教程，从命令格式，参数说明，用法范例到解决问题实例，一步步深入说明。
rogue-server:多人 rogue-like 游戏服务器
06-13
流氓服务器 多人 rogue-like 游戏服务器。 介绍 即将推出。 执照 麻省理工学院
Rogue-DHCP-Server-Discovery-Tool:发现恶意DHCP服务器（如果有）的Python代码
03-28
Rogue-DHCP-Server-Discovery-Tool:发现恶意DHCP服务器（如果有）的Python代码
Jonathan Brill - Rogue Waves- Future-Proof Your Business to Surv
最新发布
06-27
Jonathan Brill - Rogue Waves_ Future-Proof Your Business to Survive and Profit from Radical 乔纳森布里尔-流氓波_未来证明你的业务生存和利润的激进
chamber-crawler:CS 246 最终项目 - 简化的类 Rogue 游戏
07-09
密室履带 CS 246 最终项目 - 简化的类 Rogue 游戏
lldp协议_使用tcpdump抓取LLDP包得到网络拓扑
weixin_39788969的博客
12-04 3458
在典型的数据中心网络下,服务器会通过汇集交换机汇集到一起,然后汇集交换机通过核心交换机进行不同汇集交换机下服务器数据转发.典型数据中心网络,图片出处见水印通常,汇集交换机下面有24到48不等的口子,占用标准机柜1U,放在机柜的顶部.机柜中的服务器连接到交换机中.如果服务器很多,连线不规范,那么要找到哪台服务器连接到哪台交换机的那个口子会比较麻烦.此时可以使用抓LLDP包来解决.LLDP协议介绍LL...
DHCP：在网络中防止 Rogue DHCP Server
老陈醋的博客
07-21 355
DHCP：在网络中防止 Rogue DHCP Server
客户端DHCP自动获取IP地址过程详解
csdn_llw90的博客
05-02 6505
通过tcpdump抓包DHCP分析 1. 通过linux命令抓包tcpdump -i lan-v -p udp port 67 and port 68 完整抓包过程先发送广播包： DHCP客户端 -》 DHCP服务器 11:50:42.848908 IP (tos 0x10, ttl 64, id 0, offset 0, flags [none], ...
性能测试出现：java.net.NoRouteToHostException: Can‘t assign requested address (Address not available)解决方案
ping233的博客
11-16 5545
前言 在性能测试中会常常遇到java.net.NoRouteToHostException: Can’t assign requested address (Address not available)这个问题，什么原因导致的呢？ 这个原因不一定是服务器的原因，还可能是本机的问题。 一、问题报错 出现这个问题是由于liunx 分配的客户端连接端口用尽，无法建立socket连接所致，虽然socket正常关闭，但是端口不是立即释放，而是处于 TIME_WAIT 状态，默认等待60s后释放。 1、查看端口连接.
ACE_INET_Addrconnect: address not available 问题的解决
黄国强的专栏
02-04 3172
ACE_INET_Addrconnect: address not available 问题的解决 黄国强 2015/2/4 这几天要写一个多机通讯的程序，所以看了ACE。 1 问题背景 ACE版本 6.1.9Win7 x64MS VS2008 2 遇到的问题 打开 ace\ACE-6.1.9\ACE_wrappers\examples\APG\Reactor 中的例
vue报错：listen EADDRNOTAVAIL: address not available XXXXXX:8081
梧桐芊羽的博客
09-03 5776
原因： 因为机器重启，DHCP重新分配了IP。重新配置工程绑定当前分配的IP就可以了，或者修改本机的IP为静态IP，问题就解决了 解决： 按下win+R,打开cmd输入ipconfig/all，将config/index.js中的host主机修改为IPv4地址的ip地址，重启即可 ...
DHCP详解
Perfectao的博客
12-16 6232
DHCP服务IP地址自动分配原理     DHCP在提供服务时，DHCP客户端是以UDP 68号端口进行数据传输的，而DHCP服务器是以UDP 67号端口进行数据传输的。DHCP服务不仅体现在为DHCP客户端提供IP地址自动分配过程中，还体现在后面的IP地址续约和释放过程中。本节仅介绍DHCP客户端初次分配IP地址的过程。    在整个DHCP服务器为DHCP客户端初次提供IP地址自动分配
【LEDE】树莓派上玩LEDE终极指南-89-no address range available for DHCP request via xxx解决办法
wang805447391的博客
09-18 3839
最近几天LEDE的系统日志里面老是输出这样的话： no address range available for DHCP request via eth0 怎么从eth0口过来那么多的dhcp请求呢，正常来说我的wan（eth0）是没有部署DHCP Server服务的，但是老是收到DHCP请求报文。不管这些报文是谁发过来的（普通用户？攻击者？系统内部错误？其他？），我都将它except掉。
DHCP源码&报文分析
vivianliulu的博客
08-24 5224
DHCP源码&报文分析
what is a rogue Open-relay server
04-12
A rogue Open-relay server is an email server that allows anyone to send mail through it, regardless of whether they are authorized to do so or not. This type of server can be used to send spam emails ...

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值