0

is there a way how to query a specific DHCP server for an IP address? Something similar to 

dig @_IP_ADDRESS_ _server_name
dig @8.8.8.8 apple.com

Thanks

Nathan C
  • 15,059
  • 4
  • 43
  • 62
BobC
  • 432
  • 4
  • 9
  • 1
    dig looks up DNS servers - nothing to do with DHCP. You can't select between different DHCP servers. – symcbean Jun 10 '13 at 14:25
  • Are you asking how to ask a specific DNS server to resolve an address? because your example is correct. Or are you asking how to get an IP address from a specific DHCP server when there is more than one on the network? – longneck Jun 10 '13 at 14:25
  • sorry if my question wasn't clear enough. My example with dig was just an example, I'm looking for similar tool for querying DHCP server. To be more specific, I'm tracking down an issue with DHCP server and need to query specific server and capture its answer. – BobC Jun 10 '13 at 14:28
  • DHCP doesn't work that way. http://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol#DHCP_discovery the only way would be to subnet your network so the "working" server wouldn't see the requests. – Nathan C Jun 10 '13 at 14:28
  • BobC, maybe you'd be better giving an example of a ficticious command that you'd like to use, as the use of dig in your example seems to have thrown people off the scent. e.g. `dhcpquery ` might have caused less confusion. What are you trying to achieve with this? Is this for a monitoring system? – Bryan Jun 10 '13 at 20:35

3 Answers3

4

As long as you're on the same subnet as the DHCP server, you can use scapy to send a DHCP request and get the response.

For example, I've adapted it into the follow which shows me all DHCP servers on the network and what range they're serving:

[michael:~/prog/util]$ sudo ./findDhcpServers.py 
Begin emission:
Finished to send 1 packets.
*................................
Received 33 packets, got 1 answers, remaining 0 packets
DHCP offers received:
MAC: 00:1b:64:33:df:29, Server IP: 192.168.0.6, Offer IP: 192.168.0.135
    Mask: 255.255.255.0, Router: 192.168.0.1, Domain: office.myworkplace.ca

One of these methods is probably what you're after.

Teh codez:

#!/usr/bin/python
# Michael Brown <michael@supermathie.net>

# idea stolen from http://bb.secdev.org/scapy/wiki/doc/IdentifyingRogueDHCPServers

from __future__ import print_function
from scapy.all import *

import sys

# Turn off response IP address validation
conf.checkIPaddr = False

# Set up the interface
fam,hw = get_if_raw_hwaddr(conf.iface)

dhcp_discover = Ether(dst="ff:ff:ff:ff:ff:ff")/IP(src="0.0.0.0",dst="255.255.255.255")/UDP(sport=68,dport=67)/BOOTP(chaddr=hw)/DHCP(options=[("message-type","discover"),"end"])

#print("Press Ctrl-C after several seconds...", fd=sys.stderr)
ans, unans = srp(dhcp_discover, multi=True, timeout=5)

if len(ans) == 0:
    print("No DHCP offers received", file=sys.stderr)
else:
    print("DHCP offers received:")
    for pair in ans:
        p = pair[1]
        d = p[DHCP]
        print("MAC: {0}, Server IP: {1}, Offer IP: {2}\n    Mask: {3}, Router: {4}, Domain: {5}".format(
            p[Ether].src,
            p[IP].src,
            p[BOOTP].yiaddr,
            filter(lambda x: x[0] == 'subnet_mask', d.options)[0][1],
            filter(lambda x: x[0] == 'router', d.options)[0][1],
            filter(lambda x: x[0] == 'domain', d.options)[0][1],
            ))
Community
  • 1
MikeyB
  • 39,291
  • 10
  • 105
  • 189
0

The easiest way to capture the DHCP exchange would be to run a packet capture on the DHCP Server or Client during the configuration process (easily done by ipconfig /release /renew on Windows and dhclient -r; dhclient on *nix). I highly recommend using Wireshark for this, or capturing the exchange in a command line utility (tcpdump for example in *nix) then opening the capture in Wireshark for easy analysis of the exchange.

Chris S
  • 77,945
  • 11
  • 124
  • 216
0

dhclient (on some systems at least) has a -s option to specify a particular server rather than using the default broadcast.

Paul Haldane
  • 4,517
  • 1
  • 21
  • 32