Mixing
Something about DHCP broadcasts and subnets I don't quite get
Clash Royale CLAN TAG#URR8PPP
up vote
3
down vote
favorite
I am not completely oblivious when it comes to networks but here is something I can't wrap my head around.
Imagine we have a network like in the picture. 6 hosts on one layer 2 network, no VLANs. The network is supposed to be segmented into 2 subnets, with one DHCP server each. The DHCP servers have fixed IP addresses, so they know in which subnet they belong, obviously.
Then new clients get plugged in. They don't know nothing about which subnet they're supposed to be in and send their DHCPDISCOVER to the ethernet broadcast 255.255.255.255, so it goes to both DHCP servers. Both servers reply with an offer. Now here's my question: How does the client know, which DHCPOFFER he's supped to accept?
networking dhcp
edited 9 mins ago
Fazer87
9,89712338
asked 2 hours ago
Michael Niemand
1255
add a comment |Â
up vote
3
down vote
favorite
I am not completely oblivious when it comes to networks but here is something I can't wrap my head around.
Imagine we have a network like in the picture. 6 hosts on one layer 2 network, no VLANs. The network is supposed to be segmented into 2 subnets, with one DHCP server each. The DHCP servers have fixed IP addresses, so they know in which subnet they belong, obviously.
Then new clients get plugged in. They don't know nothing about which subnet they're supposed to be in and send their DHCPDISCOVER to the ethernet broadcast 255.255.255.255, so it goes to both DHCP servers. Both servers reply with an offer. Now here's my question: How does the client know, which DHCPOFFER he's supped to accept?
networking dhcp
edited 9 mins ago
Fazer87
9,89712338
asked 2 hours ago
Michael Niemand
1255
Compare this question and answers there.
– Kamil Maciorowski
2 mins ago
add a comment |Â
up vote
3
down vote
favorite
up vote
3
down vote
favorite
I am not completely oblivious when it comes to networks but here is something I can't wrap my head around.
Imagine we have a network like in the picture. 6 hosts on one layer 2 network, no VLANs. The network is supposed to be segmented into 2 subnets, with one DHCP server each. The DHCP servers have fixed IP addresses, so they know in which subnet they belong, obviously.
Then new clients get plugged in. They don't know nothing about which subnet they're supposed to be in and send their DHCPDISCOVER to the ethernet broadcast 255.255.255.255, so it goes to both DHCP servers. Both servers reply with an offer. Now here's my question: How does the client know, which DHCPOFFER he's supped to accept?
networking dhcp
edited 9 mins ago
Fazer87
9,89712338
asked 2 hours ago
Michael Niemand
1255
I am not completely oblivious when it comes to networks but here is something I can't wrap my head around.
Imagine we have a network like in the picture. 6 hosts on one layer 2 network, no VLANs. The network is supposed to be segmented into 2 subnets, with one DHCP server each. The DHCP servers have fixed IP addresses, so they know in which subnet they belong, obviously.
Then new clients get plugged in. They don't know nothing about which subnet they're supposed to be in and send their DHCPDISCOVER to the ethernet broadcast 255.255.255.255, so it goes to both DHCP servers. Both servers reply with an offer. Now here's my question: How does the client know, which DHCPOFFER he's supped to accept?
networking dhcp
networking dhcp
edited 9 mins ago
Fazer87
9,89712338
asked 2 hours ago
Michael Niemand
1255
edited 9 mins ago
Fazer87
9,89712338
asked 2 hours ago
Michael Niemand
1255
edited 9 mins ago
Fazer87
9,89712338
edited 9 mins ago
Fazer87
9,89712338
edited 9 mins ago
Fazer87
9,89712338
9,89712338
asked 2 hours ago
Michael Niemand
1255
asked 2 hours ago
Michael Niemand
1255
asked 2 hours ago
Michael Niemand
1255
1255
Compare this question and answers there.
– Kamil Maciorowski
2 mins ago
add a comment |Â
Compare this question and answers there.
– Kamil Maciorowski
2 mins ago
Compare this question and answers there.
– Kamil Maciorowski
2 mins ago
Compare this question and answers there.
– Kamil Maciorowski
2 mins ago
add a comment |Â
1 Answer
1
active
oldest
votes
up vote
3
down vote
accepted
Simplest answer - first come first served.
If you had multiple VLANs and 10.10.10.0/24 was on a different VLAN to 10.10.20.0/24 - the broadcast wouldn't cross VLANs.
If the DHCP Server was on a separate VLAN to the clients, an iphelper on the routing interface between vlans would direct the broadcast onto the correct location.
In your scenario where you have 2 separate networks within the same VLAN (or lack thereof) serving up different subnets - its a race.
DHCP Serves up using the following transactions:
- DHCP Discovery (DHCPDISCOVER) - Client Broadcast - "Is there a DHCP
Server out there?" - DHCP Offer (DHCPOFFER) - Server to Client - "Yeah, I'm here and available!"
- DHCP Request (DHCPREQUEST) - Client to Server "Awesome, Can I have an address please?"
- DHCP Acknowledgement (DHCPACK) - Server to client "Sure, here's an IP, a mask, a gateway, some DNS/WINS Servers, a Time Server, and all the other stuff configured for your scope"
All of this happens on UDP Ports 67 for the server and 68 for the client.
As soon as Step 2 is reached - the client will stop "listening" to other DHCP Servers responses - its happy dealing with the first Server to give it some attention.
As a side note - there is actually a well known series of DoS (Denial of Service) attacks which abuse this right. An attacker plugs in a device which responds and sends out DHCPOFFER packets and then doesn't send DHCPACK out when asked... over and over and over again. There is also another DoS attack where "fake" DHCP Servers offer out addresses that can't be routed or that conflict with other IPs it's sniffed to mess with networks.
answered 2 hours ago
Fazer87
9,89712338
2
And therefore the short answer to "But then how do I run multiple subnets on a single Layer-2 segment?" is "You don't." (Yes, there are ways, but it's not something you should generally do. One layer-2 domain = one subnet.)
– grawity
2 hours ago
Thank you guys, that really clicked with me. I always wondered how this would be possible, but it simply isn't. So the take away is: Have a router / layer 3 switch between subnets or segment with VLANs, am I right?
– Michael Niemand
2 hours ago
In general, yes, you need either VLANs or physical segmentation. Sharing a L2 domain would be doable only if both of your DHCP servers were restricted to handling "known" clients (e.g. by list of 'static leases' with allowed MAC addresses).
– grawity
34 mins ago
add a comment |Â
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
3
down vote
accepted
Simplest answer - first come first served.
If you had multiple VLANs and 10.10.10.0/24 was on a different VLAN to 10.10.20.0/24 - the broadcast wouldn't cross VLANs.
If the DHCP Server was on a separate VLAN to the clients, an iphelper on the routing interface between vlans would direct the broadcast onto the correct location.
In your scenario where you have 2 separate networks within the same VLAN (or lack thereof) serving up different subnets - its a race.
DHCP Serves up using the following transactions:
- DHCP Discovery (DHCPDISCOVER) - Client Broadcast - "Is there a DHCP
Server out there?" - DHCP Offer (DHCPOFFER) - Server to Client - "Yeah, I'm here and available!"
- DHCP Request (DHCPREQUEST) - Client to Server "Awesome, Can I have an address please?"
- DHCP Acknowledgement (DHCPACK) - Server to client "Sure, here's an IP, a mask, a gateway, some DNS/WINS Servers, a Time Server, and all the other stuff configured for your scope"
All of this happens on UDP Ports 67 for the server and 68 for the client.
As soon as Step 2 is reached - the client will stop "listening" to other DHCP Servers responses - its happy dealing with the first Server to give it some attention.
As a side note - there is actually a well known series of DoS (Denial of Service) attacks which abuse this right. An attacker plugs in a device which responds and sends out DHCPOFFER packets and then doesn't send DHCPACK out when asked... over and over and over again. There is also another DoS attack where "fake" DHCP Servers offer out addresses that can't be routed or that conflict with other IPs it's sniffed to mess with networks.
answered 2 hours ago
Fazer87
9,89712338
2
And therefore the short answer to "But then how do I run multiple subnets on a single Layer-2 segment?" is "You don't." (Yes, there are ways, but it's not something you should generally do. One layer-2 domain = one subnet.)
– grawity
2 hours ago
Thank you guys, that really clicked with me. I always wondered how this would be possible, but it simply isn't. So the take away is: Have a router / layer 3 switch between subnets or segment with VLANs, am I right?
– Michael Niemand
2 hours ago
In general, yes, you need either VLANs or physical segmentation. Sharing a L2 domain would be doable only if both of your DHCP servers were restricted to handling "known" clients (e.g. by list of 'static leases' with allowed MAC addresses).
– grawity
34 mins ago
add a comment |Â
up vote
3
down vote
accepted
Simplest answer - first come first served.
If you had multiple VLANs and 10.10.10.0/24 was on a different VLAN to 10.10.20.0/24 - the broadcast wouldn't cross VLANs.
If the DHCP Server was on a separate VLAN to the clients, an iphelper on the routing interface between vlans would direct the broadcast onto the correct location.
In your scenario where you have 2 separate networks within the same VLAN (or lack thereof) serving up different subnets - its a race.
DHCP Serves up using the following transactions:
- DHCP Discovery (DHCPDISCOVER) - Client Broadcast - "Is there a DHCP
Server out there?" - DHCP Offer (DHCPOFFER) - Server to Client - "Yeah, I'm here and available!"
- DHCP Request (DHCPREQUEST) - Client to Server "Awesome, Can I have an address please?"
- DHCP Acknowledgement (DHCPACK) - Server to client "Sure, here's an IP, a mask, a gateway, some DNS/WINS Servers, a Time Server, and all the other stuff configured for your scope"
All of this happens on UDP Ports 67 for the server and 68 for the client.
As soon as Step 2 is reached - the client will stop "listening" to other DHCP Servers responses - its happy dealing with the first Server to give it some attention.
As a side note - there is actually a well known series of DoS (Denial of Service) attacks which abuse this right. An attacker plugs in a device which responds and sends out DHCPOFFER packets and then doesn't send DHCPACK out when asked... over and over and over again. There is also another DoS attack where "fake" DHCP Servers offer out addresses that can't be routed or that conflict with other IPs it's sniffed to mess with networks.
answered 2 hours ago
Fazer87
9,89712338
2
And therefore the short answer to "But then how do I run multiple subnets on a single Layer-2 segment?" is "You don't." (Yes, there are ways, but it's not something you should generally do. One layer-2 domain = one subnet.)
– grawity
2 hours ago
Thank you guys, that really clicked with me. I always wondered how this would be possible, but it simply isn't. So the take away is: Have a router / layer 3 switch between subnets or segment with VLANs, am I right?
– Michael Niemand
2 hours ago
In general, yes, you need either VLANs or physical segmentation. Sharing a L2 domain would be doable only if both of your DHCP servers were restricted to handling "known" clients (e.g. by list of 'static leases' with allowed MAC addresses).
– grawity
34 mins ago
add a comment |Â
up vote
3
down vote
accepted
up vote
3
down vote
accepted
Simplest answer - first come first served.
If you had multiple VLANs and 10.10.10.0/24 was on a different VLAN to 10.10.20.0/24 - the broadcast wouldn't cross VLANs.
If the DHCP Server was on a separate VLAN to the clients, an iphelper on the routing interface between vlans would direct the broadcast onto the correct location.
In your scenario where you have 2 separate networks within the same VLAN (or lack thereof) serving up different subnets - its a race.
DHCP Serves up using the following transactions:
- DHCP Discovery (DHCPDISCOVER) - Client Broadcast - "Is there a DHCP
Server out there?" - DHCP Offer (DHCPOFFER) - Server to Client - "Yeah, I'm here and available!"
- DHCP Request (DHCPREQUEST) - Client to Server "Awesome, Can I have an address please?"
- DHCP Acknowledgement (DHCPACK) - Server to client "Sure, here's an IP, a mask, a gateway, some DNS/WINS Servers, a Time Server, and all the other stuff configured for your scope"
All of this happens on UDP Ports 67 for the server and 68 for the client.
As soon as Step 2 is reached - the client will stop "listening" to other DHCP Servers responses - its happy dealing with the first Server to give it some attention.
As a side note - there is actually a well known series of DoS (Denial of Service) attacks which abuse this right. An attacker plugs in a device which responds and sends out DHCPOFFER packets and then doesn't send DHCPACK out when asked... over and over and over again. There is also another DoS attack where "fake" DHCP Servers offer out addresses that can't be routed or that conflict with other IPs it's sniffed to mess with networks.
answered 2 hours ago
Fazer87
9,89712338
Simplest answer - first come first served.
If you had multiple VLANs and 10.10.10.0/24 was on a different VLAN to 10.10.20.0/24 - the broadcast wouldn't cross VLANs.
If the DHCP Server was on a separate VLAN to the clients, an iphelper on the routing interface between vlans would direct the broadcast onto the correct location.
In your scenario where you have 2 separate networks within the same VLAN (or lack thereof) serving up different subnets - its a race.
DHCP Serves up using the following transactions:
- DHCP Discovery (DHCPDISCOVER) - Client Broadcast - "Is there a DHCP
Server out there?" - DHCP Offer (DHCPOFFER) - Server to Client - "Yeah, I'm here and available!"
- DHCP Request (DHCPREQUEST) - Client to Server "Awesome, Can I have an address please?"
- DHCP Acknowledgement (DHCPACK) - Server to client "Sure, here's an IP, a mask, a gateway, some DNS/WINS Servers, a Time Server, and all the other stuff configured for your scope"
All of this happens on UDP Ports 67 for the server and 68 for the client.
As soon as Step 2 is reached - the client will stop "listening" to other DHCP Servers responses - its happy dealing with the first Server to give it some attention.
As a side note - there is actually a well known series of DoS (Denial of Service) attacks which abuse this right. An attacker plugs in a device which responds and sends out DHCPOFFER packets and then doesn't send DHCPACK out when asked... over and over and over again. There is also another DoS attack where "fake" DHCP Servers offer out addresses that can't be routed or that conflict with other IPs it's sniffed to mess with networks.
answered 2 hours ago
Fazer87
9,89712338
answered 2 hours ago
Fazer87
9,89712338
answered 2 hours ago
Fazer87
9,89712338
answered 2 hours ago
Fazer87
9,89712338
9,89712338
2
And therefore the short answer to "But then how do I run multiple subnets on a single Layer-2 segment?" is "You don't." (Yes, there are ways, but it's not something you should generally do. One layer-2 domain = one subnet.)
– grawity
2 hours ago
Thank you guys, that really clicked with me. I always wondered how this would be possible, but it simply isn't. So the take away is: Have a router / layer 3 switch between subnets or segment with VLANs, am I right?
– Michael Niemand
2 hours ago
In general, yes, you need either VLANs or physical segmentation. Sharing a L2 domain would be doable only if both of your DHCP servers were restricted to handling "known" clients (e.g. by list of 'static leases' with allowed MAC addresses).
– grawity
34 mins ago
add a comment |Â
2
And therefore the short answer to "But then how do I run multiple subnets on a single Layer-2 segment?" is "You don't." (Yes, there are ways, but it's not something you should generally do. One layer-2 domain = one subnet.)
– grawity
2 hours ago
Thank you guys, that really clicked with me. I always wondered how this would be possible, but it simply isn't. So the take away is: Have a router / layer 3 switch between subnets or segment with VLANs, am I right?
– Michael Niemand
2 hours ago
In general, yes, you need either VLANs or physical segmentation. Sharing a L2 domain would be doable only if both of your DHCP servers were restricted to handling "known" clients (e.g. by list of 'static leases' with allowed MAC addresses).
– grawity
34 mins ago
2
2
And therefore the short answer to "But then how do I run multiple subnets on a single Layer-2 segment?" is "You don't." (Yes, there are ways, but it's not something you should generally do. One layer-2 domain = one subnet.)
– grawity
2 hours ago
And therefore the short answer to "But then how do I run multiple subnets on a single Layer-2 segment?" is "You don't." (Yes, there are ways, but it's not something you should generally do. One layer-2 domain = one subnet.)
– grawity
2 hours ago
Thank you guys, that really clicked with me. I always wondered how this would be possible, but it simply isn't. So the take away is: Have a router / layer 3 switch between subnets or segment with VLANs, am I right?
– Michael Niemand
2 hours ago
Thank you guys, that really clicked with me. I always wondered how this would be possible, but it simply isn't. So the take away is: Have a router / layer 3 switch between subnets or segment with VLANs, am I right?
– Michael Niemand
2 hours ago
In general, yes, you need either VLANs or physical segmentation. Sharing a L2 domain would be doable only if both of your DHCP servers were restricted to handling "known" clients (e.g. by list of 'static leases' with allowed MAC addresses).
– grawity
34 mins ago
In general, yes, you need either VLANs or physical segmentation. Sharing a L2 domain would be doable only if both of your DHCP servers were restricted to handling "known" clients (e.g. by list of 'static leases' with allowed MAC addresses).
– grawity
34 mins ago
add a comment |Â
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1370188%2fsomething-about-dhcp-broadcasts-and-subnets-i-dont-quite-get%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Compare this question and answers there.
– Kamil Maciorowski
2 mins ago