Original subtitles

Okay so let's have a look at why shock now before getting into the nitty gritty.

I want to show you a really nice option in why a shock notice here we have messages discover offer request

and acknowledgement in why shock.

You can go to the statistics menu and click flow graph and you can see messages being sent on the network.

I'm going to limit this to the photo which at the moment is DHEA P.

And notice what you can see in the output here.

Make this a bit smaller so I can zoom in.

Notice we've got DHEA P discover with this transaction I.D. ending in c 3.

Here's an offer.

He has a request and he has an acknowledgement.

This shows graphically the process of how the client.

Notice there is no IP address here sends a broadcast message to 5 5 2 4 5 2 4 5 2 4 5 trying to discover

the ATP servers on the network.

So it's saying who's out there.

I need an IP address the DHB server offers an IP address to the client.

There may be multiple the ATP serves on the network so the DHB service that receive these discover messages

will offer IP addresses to the client.

The client will then request one of those IP addresses.

In this example is only one DHB server so it's only going to request the IP address from that DHB server

but if there were multiple DHB servers in the network it would request an IP address from one of them.

Typically the first one to offer an IP address and then the DHB server will acknowledge that request.

This is a great option and while shock you can graphically see discover offer request and acknowledgement

again discover try and discover DHB servers on the network.

The HP server will offer an IP address to the client.

The client will then accept that offer and request the IP address from that DHB server and the DHB server

will acknowledge that request now notice in the why shock capture.

I've got a DHB discover DHB offer DHB request and DHB acknowledgement notice the IP address on the HP

Discover there is no IP address.

It's sending a message to a broadcast address so the C is trying to discover a DHB server on the Internet.

Notice the MAC address ends in 80 b 0 going back to my P C notice MAC address ends in 8 0 b 0.

So this message is being sent from that Windows P C we can also see that by looking at the client identifier.

Notice MAC address their message type is DHB discover the piece is trying to discover a DHB server.

And as mentioned notice it's requesting to use this IP address.

The reason for that is because once again the P.C. use that IP address previously and is trying to get

the same IP address.

If a new device boots up it won't do that and I'll show you that in a moment.

But because this M.S. age when 10.

P.S. previously was allocated this IP address it's simply requesting the same IP address again.

Notice you can see under whose name the name of this window's P.C. once again.

There it is on the windows host.

So in windows and in wire shock so first step is Discover piece he is trying to discover the DTP server.

Now this IP address once again 10 1 1 2 5 4 is the DHB server.

In our example this is the router Rod is configured with this IP address so the router replies back

to a broadcast address because the client doesn't have an IP address yet it can send a message to an

IP address because the client doesn't have an IP address so broadcasts saying your IP address is this

so your client IP addresses this your client MAC address remember ending an 8 0 0 0.

That is the MAC address of this windows.

P.S. so that MAC address will get this IP address.

Option 53.

This is an offer from this DHB server I'll just jump back for a moment.

Notice the protocol used here is UDP from source port 68 to destination port 67.

But here we we're using DHL P which uses UDP.

In this example source port is 67 going to destination port 68.

And again the server with this identifier is allocating an IP address to the client with a lease time

of one day.

It needs to renew after 12 days.

As I said previously typically after half the lease period clients will be told to renew notice subnet

mask default gateway.

Option 3 here default gateway or broader DNS server option 6 and option 15 is domain name.

So that's the offer from the DHB server to the client.

The client then requests that IP address the reason why is we could have multiple servers offering IP

addresses to the client and it needs to request one of them.

So you could have two DHB servers offering IP addresses to the client it needs to choose one typically

chooses the one that replied first.

So going up notice it UDP source port 68 going to 67 mac addresses the client.

It's a request.

So we're requesting that this MAC address use this IP address the IP address that was offered by the

server so back again notice the server offered that IP address to the client and that's the IP address

that the client is requesting to use the requested IP addresses this from this DHB server.

This is my who's name because this is Windows that asks for net by us old protocol ask for other information

such as private classless static right et cetera.

And then lastly the server acknowledges that request.

So UDP source port 67 to port 68.

The service saying I acknowledge this as your IP address.

This is your mac address.

It's an acknowledgement and then similar kind of information is displayed once again.

So notice we have four messages here.

Discover offer request and acknowledgement.

Okay.

So that was why Ashok let's have a look on the road Roda.

So again this is the MAC address of our client.

This is the IP address that it got from the DHB server on the road and now show IP DHB bindings.

Notice this MAC address was allocated this IP address automatically show IPD HP server statistics.

We can see as an example that we have one address pull.

There's been five discovered messages were received.

There's been told for DHB requests and three offers and five acknowledgements a bunch of stuff has been

going on in the background here.

Most important command here is typically binding so that you can see which client received which IP

address.

Okay so I have got a linux host here.

I'll start this linux host up go back into why a shock and what you'll see is we've got a bunch of DTP

messages now.

What I can do very nicely in why shock is do a filter so that I only see one host.

Notice this MAC address here ends in C 955 that is the MAC address of the Linux client

we can see as an example that this Linux client has obtained this IP address.

I have Conficker because this is Linux shows me IP address shows me the MAC address ending and c 955

in y shock I could actually add this as a filter.

So add this as and selected.

So this changes the Y shock filter to only show me that P C rather than the windows.

P.S. Some only seeing the messages from that Linux client.

So notice she has a Discover message sent out a broadcast.

This is the offer from the DSP server.

He has a request and he has an acknowledgement.

So if we look at the Discover message notice it doesn't have an IP address.

It's sending out a broadcast with its Mac address trying to discover DHB server it wants various parameters

including A.P. the DHB server replies back with an offer offering this IP address 10 1 1 1 2 this client

DHB servers this again lease time renewal time.

Other information is displayed so on the client I can see that it got given this IP address by the DHB

server it requested that IP address so request of this IP address and the DHB server acknowledged that

IP address.

Okay so that was quite a detailed video.

I hope after this video you really understand how DHB works.