14

I read the following excerpt in a CCNA prep book and it doesn't sit well with me:

So during IP address assignment, a DHCP server checks for conflicts using the Ping program to test the availability of the address before it's assigned from the pool. If no host replies, then the DHCP server assumes that the IP address is not already allocated.

I get the goal and rationale, but is it really an ICMP request? Why not ARP?

  • Does it really use the ping-binary though? Does it not only implement the ICMP protocol by itself? – JohnyTex Nov 26 '20 at 9:09
  • ARP isn't used on all types of networks. – Barmar Nov 28 '20 at 13:28
20

The simple reason that the DHCP server uses ICMP rather than ARP is that there is no guarantee the DHCP server is on the same subnet as the client (because you could have a centralized DHCP server with relay agents).

RFC 2131 thus says:

As a consistency check, the allocating server SHOULD probe the reused address before allocating the address, e.g., with an ICMP echo request, and the client SHOULD probe the newly received address, e.g., with ARP.

  • 1
    And even using ping, across a router it isn't 100% reliable.If a client asks for a renew and the dhcp server pings, the client will respond to the ping, but the router will replace the source mac with its own which may give the server the impression that another client now holds the ip-address and thus it will refuse the renew. This can lead to very quick exhaustion of your DHCP pool and of clients getting assigned different ip-addresses on each renew. It depends on exact logic in the DHCP implementation (Microsoft DHCP server up to 2012 was notorious for this, don't now about later versions) – Tonny Nov 26 '20 at 9:29
  • A ping on the same subnet also involves an ARP lookup. – Simon Richter Nov 26 '20 at 10:31
  • @Tonny I believe that this is only supposed to be done when assigning a new address, not renewing an existing assignment. It wouldn't make sense to treat a client as conflicting with itself. – Barmar Nov 28 '20 at 13:26
  • @SimonRichter True, but the ARP lookup is incidental, not the probe itself. – Barmar Nov 28 '20 at 13:27
  • @Barmar I agree that would be the sensible thing to do. But that is not how many DHCP servers implement it unfortunately. – Tonny Nov 28 '20 at 16:28
5

It is the client that uses ARP for conflict detection, as specified in RFC 5227, which clarifies some details that are already mentioned in the DHCP specification:

-- the existing Address Resolution Protocol (ARP) provides an easy way for a host to detect this kind of misconfiguration and report it to the user. The DHCP specification [RFC2131] briefly mentions the role of ARP in detecting misconfiguration, as illustrated in the following three excerpts from RFC 2131:

  • the client SHOULD probe the newly received address, e.g., with ARP

  • The client SHOULD perform a final check on the parameters (e.g., ARP for allocated network address)

  • If the client detects that the address is already in use (e.g., through the use of ARP), the client MUST send a DHCPDECLINE message to the server

The RFC 5227 also extends from DHCP to all IPv4 address usage:

2.1. Probing an Address

Before beginning to use an IPv4 address (whether received from manual configuration, DHCP, or some other means), a host implementing this specification MUST test to see if the address is already in use, by broadcasting ARP Probe packets. This also applies when a network interface transitions from an inactive to an active state, when a computer awakes from sleep, when a link-state change signals that an Ethernet cable has been connected, when an 802.11 wireless interface associates with a new base station, or when any other change in connectivity occurs where a host becomes actively connected to a logical link.

A host MUST NOT perform this check periodically as a matter of course. This would be a waste of network bandwidth, and is unnecessary due to the ability of hosts to passively discover conflicts, as described in Section 2.4.

Assuming Windows DHCP server, the server-side conflict detection using ICMP echo requests (ping) is disabled by default, and it's recommended not to use it except in some rare circumstances:

If your network includes legacy DHCP clients (clients running a version of Windows earlier than Windows 2000), you can use server-side conflict detection provided by the DHCP Server service under specific circumstances. For example, this feature might be useful during failure recovery when scopes are deleted and recreated. For more information, see DHCP Troubleshooting.

By default, the DHCP service does not perform any conflict detection. To enable conflict detection, increase the number of ping attempts that the DHCP service performs for each address before leasing that address to a client. Note that for each additional conflict detection attempt that the DHCP service performs, additional seconds are added to the time needed to negotiate leases for DHCP clients.

1

Yes. With conflict detection enabled, the DHCP Server will ping the IP address it wants to grant a lease for to make sure no other computers are using that IP address. If the ping request receives a reply, the server will mark the IP as BAD_ADDRESS. If no response is received, the server will assign the IP address to the requesting client (The DHCP client probes the IP address by sending gratuitous ARP packets).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.