DHCP monitoring

dexto · February 7, 2010

#NoTrayIcon
#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_Change2CUI=y
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****

#include "winpcap.au3"

Global $pcap
Global $iScan = 0
Global $iAlive = 0
;declare array that will be filled with what ip's we will be scanning
Dim $aIPSendArray[2] = [1, 0]
Dim $aAliveHosts[1] = [0]

; initialise the Library
$winpcap = _PcapSetup()
If ($winpcap = -1) Then
    ConsoleWrite("WinPcap not found!")
    Exit
EndIf

; Get the interfaces list for which a capture is possible
$pcap_devices = _PcapGetDeviceList()
If ($pcap_devices = -1) Then
    ConsoleWrite(_PcapGetLastError())
    Exit
EndIf

;
$tmp = 0
For $i = 0 To UBound($pcap_devices) - 1
    ; look for Ethernet adapter with valid IP and MAC address that is not WMvare virtual.
    If IsIPAddress($pcap_devices[$i][7]) and $pcap_devices[$i][7]<>"0.0.0.0" and $pcap_devices[$i][3] == "EN10MB" And StringInStr($pcap_devices[$i][6], '00:50:56:') == 0 Then
        $tmp += 1
        $iInput = $i + 1
        $sAdapterName = StringMid($pcap_devices[$i][1], StringInStr($pcap_devices[$i][1], "'", 0, 1) + 1)
        $sAdapterName = StringMid($sAdapterName, 1, StringInStr($sAdapterName, "'", 0, 1) - 1)
        ConsoleWrite($i + 1 & ". " & $sAdapterName & " (MAC Address: " & $pcap_devices[$i][6] &" IP:"&$pcap_devices[$i][7]& ")" & @CRLF)
    EndIf
Next
If $tmp == 0 Then
    ConsoleWrite("No Net adapter found." & @CRLF)
    Exit
EndIf

; use console input to set the adapter index
If $tmp > 1 Then
    ConsoleWrite("Choose Adapter: ")
    $iInput = Number(cmdRead())
    ;$iInput = 4 ;debug
EndIf

; validate console input
If $iInput > $i Or $iInput < 1 Then
    ConsoleWrite("No such adapter." & @CRLF)
    Exit
EndIf

; Zero based index
$iInput -= 1

ConsoleWrite(@CRLF)

; start capture only UDP packets
$pcap = _PcapStartCapture($pcap_devices[$iInput][0], "udp", 1)
If ($pcap = -1) Then
    ConsoleWrite(_PcapGetLastError())
    Exit
EndIf

scan()

_PcapStopCapture($pcap)
_PcapFree()

Func scan()

    $t = TimerInit()
    $tmout = 100
    $ops = 0

    ; capture only for 60 sec.
    While TimerDiff($t) < 60000

        ; call func getPacket for every packet in the buffer
        ; when there is not packets left in the buffer
        ; returns # of packets processed (times func was called)
        $ops = _PcapDispatchToFunc($pcap, "getPacket")

        ; fancy: adjust Sleep time to amount fo the packets comming in the buffer
        If $ops > 1 Then
            $tmout -= $ops*10
            if $tmout < 1 then $tmout = 1
        ElseIf $ops == 0 And $tmout < 1000 Then
            $tmout += 10
        EndIf

        ;c($ops&@tab&$tmout)

        Sleep($tmout)
    WEnd
EndFunc   ;==>scan


;function that runs everytime we get a packet
Func getPacket($packet)

        ; source port in HEX
        $srcPort = StringMid($packet[3], 71, 4)

        ; if source port is DHCP server Dec 67 = Hex 43
        If ($srcPort == "0043") Then
            c("DHCP Server responds (MAC "&StringMid($packet[3], 15, 12)&"; IP HEX "&StringMid($packet[3], 55, 8)&") Offering IP HEX "&StringMid($packet[3], 119, 8))
            ;c("Packet: "&$packet[3])
            c()
        EndIf

        ; if target port is DHCP client Dec 68 = Hex 44
        If ($srcPort == "0044") Then
            if StringMid($packet[3], 87, 2) == "01" Then
                c("Asking for IP and PXE BOOT FILE (MAC "&StringMid($packet[3], 15, 12)&")")
            Else
                c("Asking for IP (MAC "&StringMid($packet[3], 15, 12)&")")
            EndIf
            ;c("Packet: "&$packet[3])
            c()
        EndIf

EndFunc   ;==>getPacket

Func IsIPAddress($text)
    Return StringRegExp($text, "(((25[0-5])|(2[0-4][0-9])|(1[0-9][0-9])|([1-9]?[0-9]))\.){3}((25[0-5])|(2[0-4][0-9])|(1[0-9][0-9])|([1-9]?[0-9]))")
EndFunc   ;==>IsIPAddress

Func cmdRead()
    Local $input = ""
    $file = FileOpen("con", 4)
    While 1
        $chr = FileRead($file, 1)
        If $chr = @LF Then ExitLoop
        $input &= BinaryToString($chr)
        Sleep(50)
    WEnd
    FileClose($file)
    $input = StringReplace($input, @CR, "")
    Return $input
EndFunc   ;==>cmdRead

Func c($txt="")
    ConsoleWrite($txt & @CRLF)
EndFunc   ;==>c

Attached as DHCPmon.au3

Needs:

Winpcap.au3

and winpcap installed.

This is very simple example anyone can make it much more useful with a bit of time invested.

(currently expanding it to microPXE server or microDHCP with readonly embeded TFTP for use with GHOST on my RIS server)

Edited February 8, 2010 by dexto

rogdog · February 8, 2010

No good for me. I get the following error

"Unable to Locate Component

This application has failed to start because packet.dll was not found. Re-installing the application may fix the problem"

ProgAndy · February 8, 2010

You have to install winpcap first

lgvlgv · December 6, 2012

This is great, do you know how to pick upp every message from DHCP server?

Like a kind of sniffer to see if any client on the network is haveing trubble with getting an ipaddress, if for example the scope is full on server.

lgvlgv · December 6, 2012

is this an error?

i use the script on one machine and then i release and renew the dhcpclient on second machine, it looks like both comunicate over same port and the server reply is wrong.

if i changed this

If ($srcPort == "0044") Then
c("Packet: "&$packet[1])
c("Packet: "&$packet[2])
c("Packet: "&$packet[3])
Local $stl1=StringLen ($packet[3])
if StringMid($packet[3], 87, 2) == "01" Then
c("Asking for IP and PXE BOOT FILE (MAC "&StringMid($packet[3], 15, 12)&")")
c("DHCP Server responds (MAC "&StringMid($packet[3], 15, 12)&"; IP HEX "&StringMid($packet[3], 63, 8)&") Offering IP HEX "&StringMid($packet[3],595, 8))

; Local $kebab =StringLen ($packet[3])
; c($kebab)
Else
c("Asking for IP (MAC "&StringMid($packet[3], 15, 12)&")")
EndIf
;c("Packet: "&$packet[3])
c()
EndIf

the result was this

1. Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller(NDIS6.20) (MAC Address: 00:22:15:B3:6F:2C IP:192.168.58.17)

Packet: 342

Packet: 0xFFFFFFFFFFFF00904BCEAE150800450001481CDE000080111CC800000000FFFFFFFF004400430134D2F901010600263BEFE3000000000000000000000000000000000000000000904BCEAE1500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000638253633501017401013D070100904BCEAE153204C0A83A6A0C04686F6D653C084D53465420352E30370B010F03062C2E2F1F21F92B2B02DC00FF0000000000

Asking for IP and PXE BOOT FILE (MAC 00904BCEAE15)

DHCP Server responds (MAC 00904BCEAE15; IP HEX FFFFFFFF) Offering IP HEX 153204C0

Packet: 351

Packet: 0xFFFFFFFFFFFF00904BCEAE150800450001511CDF000080111CBE00000000FFFFFFFF00440043013D899201010600263BEFE3000000000000000000000000000000000000000000904BCEAE1500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000638253633501033D070100904BCEAE153204C0A83A6A3604C0A83A010C04686F6D655108000000686F6D652E3C084D53465420352E30370B010F03062C2E2F1F21F92B2B03DC0100FF

Asking for IP and PXE BOOT FILE (MAC 00904BCEAE15)

DHCP Server responds (MAC 00904BCEAE15; IP HEX FFFFFFFF) Offering IP HEX C0A83A6A

+>13:48:21 AutoIT3.exe ended.rc:0

this is the correct ip = C0A83A6A

Edited December 6, 2012 by lgvlgv

lgvlgv · December 6, 2012

i modified it little, i know im crappy at this maybe u can update this correcly)..

#NoTrayIcon
#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_Change2CUI=y
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
#include "winpcap.au3"

Global $pcap
Global $iScan = 0
Global $iAlive = 0
;declare array that will be filled with what ip's we will be scanning
Dim $aIPSendArray[2] = [1, 0]
Dim $aAliveHosts[1] = [0]

; initialise the Library
$winpcap = _PcapSetup()
If ($winpcap = -1) Then
ConsoleWrite("WinPcap not found!")
Exit
EndIf

; Get the interfaces list for which a capture is possible
$pcap_devices = _PcapGetDeviceList()
If ($pcap_devices = -1) Then
ConsoleWrite(_PcapGetLastError())
Exit
EndIf

;
$tmp = 0
For $i = 0 To UBound($pcap_devices) - 1
; look for Ethernet adapter with valid IP and MAC address that is not WMvare virtual.
If IsIPAddress($pcap_devices[$i][7]) and $pcap_devices[$i][7]<>"0.0.0.0" and $pcap_devices[$i][3] == "EN10MB" And StringInStr($pcap_devices[$i][6], '00:50:56:') == 0 Then
$tmp += 1
$iInput = $i + 1
$sAdapterName = StringMid($pcap_devices[$i][1], StringInStr($pcap_devices[$i][1], "'", 0, 1) + 1)
$sAdapterName = StringMid($sAdapterName, 1, StringInStr($sAdapterName, "'", 0, 1) - 1)
ConsoleWrite($i + 1 & ". " & $sAdapterName & " (MAC Address: " & $pcap_devices[$i][6] &" IP:"&$pcap_devices[$i][7]& ")" & @CRLF)
EndIf
Next
If $tmp == 0 Then
ConsoleWrite("No Net adapter found." & @CRLF)
Exit
EndIf

; use console input to set the adapter index
If $tmp > 1 Then
ConsoleWrite("Choose Adapter: ")
$iInput = Number(cmdRead())
;$iInput = 4 ;debug
EndIf

; validate console input
If $iInput > $i Or $iInput < 1 Then
ConsoleWrite("No such adapter." & @CRLF)
Exit
EndIf

; Zero based index
$iInput -= 1

ConsoleWrite(@CRLF)

; start capture only UDP packets
$pcap = _PcapStartCapture($pcap_devices[$iInput][0], "udp", 1)
If ($pcap = -1) Then
ConsoleWrite(_PcapGetLastError())
Exit
EndIf

scan()

_PcapStopCapture($pcap)
_PcapFree()

Func scan()

$t = TimerInit()
$tmout = 100
$ops = 0

; capture only for 60 sec.
While TimerDiff($t) < 600000

; call func getPacket for every packet in the buffer
; when there is not packets left in the buffer
; returns # of packets processed (times func was called)
$ops = _PcapDispatchToFunc($pcap, "getPacket")

; fancy: adjust Sleep time to amount fo the packets comming in the buffer
If $ops > 1 Then
$tmout -= $ops*10
if $tmout < 1 then $tmout = 1
ElseIf $ops == 0 And $tmout < 1000 Then
$tmout += 10
EndIf

;c($ops&@tab&$tmout)

Sleep($tmout)
WEnd
EndFunc ;==>scan


;function that runs everytime we get a packet
Func getPacket($packet)

; source port in HEX
$srcPort = StringMid($packet[3], 71, 4)
; if target port is DHCP client Dec 68 = Hex 44
If ($srcPort == "0044" or StringMid($packet[3], 15, 12) = "00904BCEAE15") Then
Local $stl1=c(StringLen ($packet[3]))
if StringMid($packet[3], 87, 2) == "01" Then
if StringLen($packet[3])<"687" Then
c("Asking for IP and PXE BOOT FILE (MAC "&StringMid($packet[3], 15, 12)&")")
; c("Packet: "&$packet[3])
c("")
ElseIf StringLen($packet[3])>"686" Then
c("DHCP Server responds (MAC "&StringMid($packet[3], 15, 12)&"; IP HEX "&StringMid($packet[3], 63, 8)&") Offering IP HEX "&StringMid($packet[3],595, 8))
c("Packet: "&$packet[3])
Else
c("Packet: "&$packet[3])
EndIf
Else
c("Asking for IP renewel (MAC "&StringMid($packet[3], 15, 12)&")")
c("Packet: "&$packet[3])
EndIf
; c("Port 68: " & $packet[3])
; c("Packet: MAC: "&StringMid($packet[3], 15, 12))
;c("Packet: "&$packet[3])

EndIf
; if source port is DHCP server Dec 67 = Hex 43
If ($srcPort == "0043") Then
c("Port 67, Packet: "&$packet[3])
; c("Packet: "&$packet[1])
; c("Packet: "&$packet[2])
; c("Packet: "&$packet[3])
; c("DHCP Server responds (MAC "&StringMid($packet[3], 15, 12)&"; IP HEX "&StringMid($packet[3], 55, 8)&") Offering IP HEX "&StringMid($packet[3], 119, 8))
; c("DHCP Server responds (MAC "&StringMid($packet[3], 15, 12)&"; IP HEX "&StringMid($packet[3], 63, 8)&") Offering IP HEX "&StringMid($packet[3],595, 8))
;:c("Packet: "&$packet[3])
c("Port 67: " & $packet[3])
EndIf
EndFunc ;==>getPacket

Func IsIPAddress($text)
Return StringRegExp($text, "(((25[0-5])|(2[0-4][0-9])|(1[0-9][0-9])|([1-9]?[0-9])).){3}((25[0-5])|(2[0-4][0-9])|(1[0-9][0-9])|([1-9]?[0-9]))")
EndFunc ;==>IsIPAddress

Func cmdRead()
Local $input = ""
$file = FileOpen("con", 4)
While 1
$chr = FileRead($file, 1)
If $chr = @LF Then ExitLoop
$input &= BinaryToString($chr)
Sleep(50)
WEnd
FileClose($file)
$input = StringReplace($input, @CR, "")
Return $input
EndFunc ;==>cmdRead

Func c($txt="")
ConsoleWrite($txt & @CRLF)
EndFunc ;==>c

the result became this, and i would like/try to find all responses for the "Asking for IP renewel"

lines after..

PS. i hardcoded my mac to filter the output.

OUTPUT:

1. Atheros AR8121/AR8113/AR8114 PCI-E Ethernet Controller(NDIS6.20) (MAC Address: 00:22:15:B3:6F:2C IP:192.168.58.17)

686

Asking for IP and PXE BOOT FILE (MAC 00904BCEAE15)

704

DHCP Server responds (MAC 00904BCEAE15; IP HEX FFFFFFFF) Offering IP HEX C0A83A6A

Packet: 0xFFFFFFFFFFFF00904BCEAE15080045000151461200008011F38A00000000FFFFFFFF00440043013DF69801010600C892E085000000000000000000000000000000000000000000904BCEAE1500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000638253633501033D070100904BCEAE153204C0A83A6A3604C0A83A010C04686F6D655108000000686F6D652E3C084D53465420352E30370B010F03062C2E2F1F21F92B2B03DC0100FF

222