First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

Malformed bootp packet

Hi

I'm quite new to networking and a uni student, i'm trying to implement a dhcp server in Golang according to the RFC. I started the server and tried to test it with dhcping

The reply from my DHCP server implementation as captured by wireshark in this pastebin https://pastebin.com/raw/F1q6yjsV, i can't seem to figure out why wireshark reports it as a malformed packet

Added some debug logs from my server https://pastebin.com/raw/8zCBfssY

Link to packet capture https://filebin.net/6a3likk67xtsesbz/...

thebadass's avatar
5
thebadass
asked 2024-04-13 12:45:06 +0000, updated 2024-04-13 14:23:42 +0000
edit flag offensive 0 remove flag close merge delete

Comments

Can you share a capture file of the packet on a public file share then update the question with a link to it.

Chuckc's avatar Chuckc (2024-04-13 13:01:32 +0000) edit
more
  • delete

@chucku i just did that, thanks!

thebadass's avatar thebadass (2024-04-13 13:18:04 +0000) edit
more
  • delete
add a comment see more comments

1 Answer

1

The client hardware address field ('chaddr') in DHCP is a fixed 16 octets. The hlen field indicates the length of the hardware address, and thus the number of those octets used. However, the remaining octets _must_ be present as padding. Your server is not including the 10 padding octets necessary and is only transmitting a 6 octet _chaddr_ field; put another way, the DHCP magic cookie is being transmitted inside the _file_ field as everything is shifted by 10 octets, and this leads to the packet being seen as malformed. As the first four bytes of the options field are not the DHCP Magic Cookie, it is instead interpreted as BOOTP.

johnthacker's avatar
156
johnthacker
answered 2024-04-13 16:37:13 +0000
edit flag offensive 0 remove flag delete link
more

Comments

Solved my issue and the packet is correctly interpreted now, thanks a bunch!

thebadass's avatar thebadass (2024-04-13 17:50:45 +0000) edit
more
  • delete

How does the client get the response if sent to 67 not 68?

No. Time    Source  UDP Srcport Destination UDP Dstport Protocol    Length  Info
78  5.882497    127.0.0.1   68  127.0.0.1   67  DHCP    282 DHCP Request  - Transaction ID 0x3b771a66
79  5.882816    127.0.0.1   67  127.0.0.1   67  BOOTP   328 Boot Reply[Malformed Packet]
Chuckc's avatar Chuckc (2024-04-14 20:19:06 +0000) edit
more
  • delete

I later caught on that, and got it fixed.

thebadass's avatar thebadass (2024-04-21 16:49:47 +0000) edit
more
  • delete
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer