TP-Link T3700G-52TQ User Manual page 351

(2) DHCP-OFFER Stage: Upon receiving the DHCP-DISCOVER packet, the DHCP Server
selects an IP address from the IP pool according to the assigning priority of the IP
addresses and replies to the Client with DHCP-OFFER packet carrying the IP address
and other information.
(3) DHCP-REQUEST Stage: In the situation that there are several DHCP Servers sending
the DHCP-OFFER packets, the Client will only respond to the first received
DHCP-OFFER packet and broadcast the DHCP-REQUEST packet which includes the
assigned IP address of the DHCP-OFFER packet.
(4) DHCP-ACK Stage: Since the DHCP-REQUEST packet is broadcasted, all DHCP Servers
on the network segment can receive it. However, only the requested Server processes
the request. If the DHCP Server acknowledges assigning this IP address to the Client, it
will send the DHCP-ACK packet back to the Client. Otherwise, the Server will send the
DHCP-NAK packet to refuse assigning this IP address to the Client.
Option 82

The DHCP packets are classified into 8 types with the same format basing on the format of
BOOTP packet. The difference between DHCP packet and BOOTP packet is the Option field.
The Option field of the DHCP packet is used to expand the function, for example, the DHCP can
transmit the control information and network parameters via the Option field, so as to assign
the IP address to the Client dynamically. For the details of the DHCP Option, please refer to RFC
2132.
Option 82 records the location of the DHCP Client. Upon receiving the DHCP-REQUEST packet,
the switch adds the Option 82 to the packet and then transmits the packet to DHCP Server.
Administrator can be acquainted with the location of the DHCP Client via Option 82 so as to
locate the DHCP Client for fulfilling the security control and account management of Client. The
Server supported Option 82 also can set the distribution policy of IP addresses and the other
parameters according to the Option 82, providing more flexible address distribution way.
Option 82 can contain 255 sub-options at most. If Option 82 is defined, at least a sub-option
should be defined. This switch supports two sub-options: Circuit ID and Remote ID. Since there
is no universal standard about the content of Option 82, different manufacturers define the
sub-options of Option 82 to their need. For this switch, the sub-options are defined as the
following: The Circuit ID is defined to be the number of the port which receives the DHCP
Request packets and its VLAN number. The Remote ID is defined to be the MAC address of
DHCP Snooping device which receives the DHCP Request packets from DHCP Clients.
DHCP Cheating Attack

During the working process of DHCP, generally there is no authentication mechanism between
Server and Client. If there are several DHCP servers in the network, network confusion and
security problem will happen. The common cases incurring the illegal DHCP servers are the
following two:
(1) It's common that the illegal DHCP server is manually configured by the user by mistake.
(2) Hacker exhausted the IP addresses of the normal DHCP server and then pretended to
be a legal DHCP server to assign the IP addresses and the other parameters to Clients.
For example, hacker used the pretended DHCP server to assign a modified DNS server
address to users so as to induce the users to the evil financial website or electronic
338