How to Configure a Router to Use DHCP

Steps to configure router to use DHCP:

1. Connect to your router (by typing 192.168.0.1 or 192.168.1.1 into the URL bar) and log in. Check your user manual or documentation if you do not know the log-in credentials.

2. Make sure you are in the Setup -> Basic Setup category.

3. Scroll down until you see 'DHCP Server' - if it is disabled, select 'Enable'

4. If you want, you can change the number that the DHCP IP assigning starts. This is optional, and is totally dependant on personal preference.In this picture, the maximum number of DHCP clients is 3. You may need to increase this number according to how many people will need a dynamic IP address on your network. Once the max is reached, no one else can get an address until one expires!

5. Use the DNS servers provided to you by your ISP, or use the following DNS servers: 205.152.37.254, 205.152.132.235, 205.152.132.23; There are many DNS servers out there. It's best to use your ISP's if possible.

6. Scroll down and click 'Save Settings'.

7. Open up the network configurations for the computers on your network (Control Panel -> Network Connections -> Local Area Connection or Wireless Connection) and select 'Obtain IP address automatically'

Related Post:

How to Troubleshoot a DHCP Server?
Installation of DHCP Server in 2008

Source: wikihow

How to Enable DHCP Server Logging?

To enable enhanced DHCP logging, perform the following steps:

1. Start the DHCP administration tool (go to Start, Programs, Administrative Tools, and click DHCP).
2. Right-click the DHCP server, and select Properties from the context menu.
3. Select the General tab.
4. Select the "Enable DHCP audit logging" check box.
5. Click OK.

Windows 2000 will now create a DHCP log file in the %systemroot%\system32\dhcp directory for each day using a DhcpSrvLog.XXX file format.

Common audit codes that might appear in the log include

* 00—The log was started.
* 01—The log was stopped.
* 02—The log was temporarily paused due to low disk space.
* 10—A new IP address was leased to a client.
* 11—A lease was renewed by a client.
* 12—A lease was released by a client.
* 13—An IP address was found to be in use on the network.
* 14—A lease request could not be satisfied because the scope's address pool was exhausted.
* 15—A lease was denied.
* 16—A lease was deleted.
* 17—A lease was expired.
* 20—A BOOTP address was leased to a client.
* 21—A dynamic BOOTP address was leased to a client.
* 22—A BOOTP request could not be satisfied because the scope's address pool for BOOTP was exhausted.
* 23—A BOOTP IP address was deleted after verifying that it wasn't in use.

The DHCP Server uses codes above 50 for Rogue Server Detection information.

windowsitpro.com

Installation of DHCP Server in 2008

Installing DHCP server in Windows 2008 Infrastructure

DHCP plays a very important role in leasing out the IP addresses to clients, when you are running this service into your server. In Windows 2008 Server there have been some improvements over Windows 2003 Server, especially major improvements in backup and restore.

Understanding DHCP process

Workstation boots up and broadcast is sent to all nodes on a subnet. This broadcast works on UDP port 68 and server is listening to these broadcasts on UDP port 67.
Installing DHCP server in Windows 2008

1. Go to start, Programs, Administrative tools in that Server Manager
2. Select Roles node in Server Manager, then click Add roles and select DHCP Server
3. Verify the network Bindings option.
4. Then IP v4 Settings page will come, Provide domain name and DNS IP address.
5. IF wins is required in your environment provide those details also.
6. Then Enter Start IP and End IP address range along with SM and gateway
7. In DHCP v6 stateless mode select enable if it's required
8. After the above steps you will see your DHCP server has just been configured.

Improvements in Windows 2008 DHCP (Backup and Restore)

In Windows 2008 DHCP Server you no longer need to export those registry keys or manually move database to different server, because backup and restore can be performed from DHCP console.

To Backup DHCP database

1. Open DHCP manager
2. Right Click on server name and choose backup
3. Give the path where it has to be stored

To restore DHCP database

1. Go to the server where DHCP has to be restored
2. Right click on server name and restore, give the path from where it has to be restored
3. It will ask to stop and start the services. Select Yes.

Source:symantec.com

Open-source server distro builds on Ubuntu

Zaragoza, Spain-based eBox Technologies announced the availability of version 1.0 of its Ubuntu Linux-based eBox server distribution.The open source eBox 1.0 features LDAP, DHCP, NTP, DNS, and email servers, among other features, and provides a new development framework for building add-on modules, says the company.

Aimed primarily at small- and medium-sized business, but also supporting home and enterprise users, eBox combines numerous open source packages under an umbrella framework that is said to ease network management. Most of eBox's code works to manage the internal communication among otherwise-independent network services, says eBox Technologies. As a result, administrators can more easily manage IT infrastructure as a single unit, claims the company. For example, the object-based network management system is said to enable high-level management of IP addresses, easing the administration of the firewalls and other tools.

Major features listed for eBox 1.0 include:

* User management center -- The eBox OpenLDAP-based LDAP server stores sharable user and group accounts, and its primary domain controller enables Windows machines to authenticate against it, and provides roaming profiles.

* Shared resource manager -- Based on Samba and CUPS, the file and print servers support Windows networks with features including data backup, as well as assignment of user and group permissions levels.

* Communication center -- Features include email serving, storing mailboxes, filtering mail and viruses, relaying mail with selected filters, and instant messaging using the Jabber IM network. Other communications components are based on Postfix, Spamassassin, and ClamAV.

* Network gateway -- Network management features are said to include creating virtual interfaces and 802.1q-enabled trunk interfaces, as well as setting up a default gateway, static routes, and DNS server. eBox offers load balancing and traffic shaping features, as well as the ability to filter packets, perform NAT, and manage the access to all eBox services, says the company. Its caching HTTP proxy is said to accelerate web browsing and enable filtering pages based on content and black lists. Gateway components include Squid, DansGuardian, Netfilter/Iptables, and Iproute2.

* Infrastructure manager -- Compatible with the 802.1q switching protocol, eBox enables administrators to deploy network interfaces on several VLANs through one physical network interface, says the company. Its DHCP server enables the management and assignment of IP addresses, while the NTP server can sync its time and date with external NTP servers. eBox's DNS server provides for customizable name resolution, and the Apache web server shares public information by users using HTTP and Samba. A certificate authority enables the configuration of VPNs. The various servers and components are based on ISC DHCP, NTP, Bind, Apache, OpenSSL, and OpenVPN.

Source: desktoplinux.com/news/NS3601094260.html

DNS server Trojan Flush.M spotted in the pipe

Flush.M 2.0 sets the DHCP lease time to just one hour and does not specify a DNS Domain Name, does not contain PAD options after the END option, and does set the BootP Broadcast Bit. BootP is typically used for configuring diskless workstations or for rolling out PC installations across a large network. SANS recommends monitoring network traffic for signs that systems are attempting to connect to any unapproved DNS server other than the one approved by the local DHCP server.

Security experts warned this week that they have seen a new variant of the DNS-changing Trojan.Flush.M malware that resembles a cyberattack from December.

The earlier version, which attempted to install a rogue DHCP server, allows cybercriminals to monitor traffic from the infected IP addresses in an organization network and direct other machines to visit malicious websites, security experts said.

The new variant is more sophisticated and hides the fake DHCP more effectively than the previous version did, experts said.

Cyberattacks, such as DNS-changing malware exploits, grew considerably in 2008. Security experts are warning that 2009 will be a year of constantly growing and changing cyberthreats, which has the potential to breach network security.

The new Trojan poses a measured risk to network security as its capable of affecting traffic flowing to and from systems that are themselves immune to the exploit Flush.M leverages

Source: mxlogic & arstechnica.com

DCHP Relay Agent settings in Windows 2000 Server

After you install and configure DHCP Relay Agent on your Windows 2000 Server, you might also want to optimize it for your network environment.

First you need to find the listing of available DHCP server. Right-click DHCP Relay Agent in the console and select Properties. This list contains all DHCP servers that will receive DHCP packets from the DHCP Relay Agent.

Other settings are located on the Properties window of each interface. Right-click the interface under DHCP Relay Agent in the console and select Properties. The window displaying the interface’s properties will be displayed, where you’ll be able to configure three options.

The first is the Relay DHCP Traffic setting. This setting basically allows you to enable or disable the DHCP Relay Agent on a given interface.

Next is the Hop-Count Threshold setting, which will let you specify the maximum number of DHCP Relay Agents between this Relay Agent and the DHCP server.

The last setting you can configure is the Boot Threshold (Seconds) setting. Here you can specify how long DHCP Relay Agent will wait before forwarding the DHCP messages to the DCHP server.

Related Post:

How to Install the DHCP Relay Agent in Windows 2000 Server?
How To Install and Configure a DHCP Server in a Workgroup in Windows Server 2003

Source: http://blogs.techrepublic.com.com/datacenter/?p=189&tag=rbxccnbtr1

Windows 2000 Server DHCP options

A client uses a local broadcast address when it first tries to contact a Windows 2000 Server DHCP server, since this is the only way to get in touch with a DHCP server without having an IP address. Problems can develop, however, when you have multiple network segments separated by routers.

Routers typically don’t pass DHCP traffic. If you have such routers and don’t have a DHCP server on every segment, your DHCP clients will get the TCP/IP configuration from any DHCP server.

To prevent this from happening, you can choose from three options. The first is to install a DHCP server on every network segment. This requires a DCHP machine and additional configuration on the server. If you have several network segments, this option doesn’t make sense. A second solution is to enable BOOTP/DHCP message traffic on your RFC 1542-compliant routers.

If you don’t have such routers or a DHCP serveron every network segment, your only option is to install DHCP Relay Agent on every network segment. DHCP Relay Agent will listen for DHCP traffic on the local network and forward these packets to a real DHCP server on another network segment.

Source:http://blogs.techrepublic.com.com/datacenter/?p=186&tag=rbxccnbtr1

How to Install the DHCP Relay Agent in Windows 2000 Server?

The DHCP Relay Agent is a special service running on Windows 2000 Server that listens to the DHCP traffic on a local network. When it hears something, it waits for a configured amount of time. This configured time allows DHCP servers from the local network to answer a client discover packet.

If no DHCP server answers, the DHCP Relay Agent will forward the DHCP traffic to a configured DHCP server on some other network segment. When a DHCP server answers the query, the query is then sent to the DHCP Relay Agent, which then forwards the packets to the local network where the client resides.

You can configure your Windows 2000 Server as a DHCP Relay Agent from the Routing And Remote Access Service console.

In this console:

Open IP Routing, right-click General, and select New Routing Protocol. Select DHCP Relay Agent and click OK. This will install the agent.

From: http://blogs.techrepublic.com.com/datacenter/?p=187&tag=rbxccnbtr1

Steps for Installing DHCP Server

The DHCP Server service is an optional Windows Component, so you can install it using the Add or Remove Programs applet in the Control Panel. There are no configuration options when you install the DHCP Server, so installation is a breeze. After you've installed the service, you'll need to authorize the server, if you have an Active Directory environment.

Using a graphical user interface

1. From the Control Panel, open the Add or Remove Programs applet.
2. Click Add/Remove Windows Components.
3. Double-click Network Services.
4. Check the box beside Dynamic Host Configuration Protocol (DHCP).
5. Click OK.
6. Click Next.
7. Click Finish.

Using a command-line interface

First, create a file using a text editor such as Notepad with the following contents:

[netoptionalcomponents]
dhcpserver=1

Next, use the sysocmgr.exe utility with the following parameters (assuming the file you just created is named c:\dhcp_install.txt):

> sysocmgr /i:%windir%\inf\sysoc.inf /u:c:\dhcp_install.txt

If the server you installed DHCP on is multihomed (i.e., has multiple active network adapters), you'll want to make sure the correct network adapters are enabled for use by the DHCP Server. You can enable or disable adapters for use by DHCP Server by doing the following:

1. Open the DHCP snap-in.
2. In the left pane, click on the server node.
3. From the menu, select Action > Properties.
4. Select the Advanced tab.
5. Click the Bindings button.
6. Make sure the interfaces where the DHCP Server should respond are checked.
7. Click OK until all dialog boxes are closed.

Source: http://www.xiitec.com/blog/?p=157

How To Install and Configure a DHCP Server in a Workgroup in Windows Server 2003

How to Install the DHCP Service

Before you can configure the DHCP service, you must install it on the server. DHCP is not installed by default during a typical installation of Windows Standard Server 2003 or Windows Enterprise Server 2003. You can install DHCP either during the initial installation of Windows Server 2003 or after the initial installation is completed.

How to Install the DHCP Service on an Existing Server

1. Click Start, point to Control Panel, and then click Add or Remove Programs.
2. In the Add or Remove Programs dialog box, click Add/Remove Windows Components.
3. In the Windows Components Wizard, click Networking Services in the Components list, and then click Details.
4. In the Networking Services dialog box, click to select the Dynamic Host Configuration Protocol (DHCP) check box, and then click OK.
5. In the Windows Components Wizard, click Next to start Setup. Insert the Windows Server 2003 CD-ROM into the computer's CD-ROM or DVD-ROM drive if you are prompted to do so. Setup copies the DHCP server and tool files to your computer.
6. When Setup is completed, click Finish.

How to Configure the DHCP Service

After you have installed the DHCP service and started it, you must create a scope, which is a range of valid IP addresses that are available for lease to the DHCP client computers on the network. Microsoft recommends that each DHCP server in your environment have at least one scope that does not overlap with any other DHCP server scope in your environment. In Windows Server 2003, DHCP servers in an Active Directory-based domain must be authorized to prevent rogue DHCP servers from coming online. Any Windows Server 2003 DHCP Server that determines itself to be unauthorized will not manage clients.

How to Create a New Scope

1. Click Start, point to Programs, point to Administrative Tools, and then click DHCP.
2. In the console tree, right-click the DHCP server on which you want to create the new DHCP scope, and then click New Scope.
3. In the New Scope Wizard, click Next, and then type a name and description for the scope. This can be any name that you want, but it should be descriptive enough so that you can identify the purpose of the scope on your network (for example, you can use a name such as "Administration Building Client Addresses"). Click Next.
4. Type the range of addresses that can be leased as part of this scope (for example, use a range of IP addresses from a starting IP address of 192.168.100.1 to an ending address of 192.168.100.100). Because these addresses are given to clients, they must all be valid addresses for your network and not currently in use. If you want to use a different subnet mask, type the new subnet mask. Click Next.
5. Type any IP addresses that you want to exclude from the range that you entered. This includes any addresses in the range described in step 4 that may have already been statically assigned to various computers in your organization. Typically, domain controllers, Web servers, DHCP servers, Domain Name System (DNS) servers, and other servers, have statically assigned IP addresses. Click Next.
6. Type the number of days, hours, and minutes before an IP address lease from this scope expires. This determines how long a client can hold a leased address without renewing it. Click Next, and then click Yes, I want to configure these options now to extend the wizard to include settings for the most common DHCP options. Click Next.
7. Type the IP address for the default gateway that should be used by clients that obtain an IP address from this scope. Click Add to add the default gateway address in the list, and then click Next.
8. If you are using DNS servers on your network, type your organization's domain name in the Parent domain box. Type the name of your DNS server, and then click Resolve to make sure that your DHCP server can contact the DNS server and determine its address. Click Add to include that server in the list of DNS servers that are assigned to the DHCP clients. Click Next, and then follow the same steps if you are using a Windows Internet Naming Service (WINS) server, by adding its name and IP address. Click Next.
9. Click Yes, I want to activate this scope now to activate the scope and allow clients to obtain leases from it, and then click Next.
10. Click Finish.
11. In the console tree, click the server name, and then click Authorize on the Action menu.

Troubleshooting

The following sections explain how to troubleshoot some of the issues that you may experience when you try to install and configure a Windows Server 2003-based DHCP server in a workgroup.
Clients Cannot Obtain an IP Address
If a DHCP client does not have a configured IP address, this typically indicates that the client was not able to contact a DHCP server. This can be caused by a network problem, or because the DHCP server is unavailable. If the DHCP server started and other clients can obtain valid addresses, verify that the client has a valid network connection and that all the related client hardware devices (including cables and network adapters) are working properly.

The DHCP Server Is Unavailable

If a DHCP server does not provide leased addresses to clients, it is frequently because the DHCP service did not start. If this is the case, the server may not be authorized to operate on the network. If you were previously able to start the DHCP service, but it has since stopped, use Event Viewer to check the System log for any entries that may explain why you cannot start the DHCP service.

To restart the DHCP service:

1. Click Start, and then click Run.
2. Type cmd, and then press ENTER.
3. Type net start dhcpserver, and then press ENTER.

-or-

1. Click Start, point to Control Panel, point to Administrative Tools, and then click Computer Management.
2. Expand Services and Applications, and then click Services.
3. Locate and then double-click DHCP Server.
4. Verify that Startup is set to Automatic and that Service Status is set to Started. If not, click Start.
5. Click OK, and then close the Computer Management window.

Source: http://support.microsoft.com/kb/323416

How to install & Configure DHCP Server in Windows 2000

Installing the DHCP Service

You can install DHCP either during or after the initial installation of Windows 2000 Server or Advanced Server, although there must be a working DNS in the environment. To validate your DNS server, click Start, click Run, type cmd, press ENTER, type ping friendly name of an existing DNS server in your environment, and then press ENTER. An unsuccessful reply generates an "Unknown Host My DNS server name" message.

To install the DHCP Service on an existing Windows 2000 Server:

1. Click Start, click Settings, and then click Control Panel.
2. Double-click Add/Remove Programs, and then click Add/Remove Windows Components.
3. In the Windows Component Wizard, click Networking Services in the Components box, and then click Details.
4. Click to select the Dynamic Host Configuration Protocol (DHCP) check box if it is not already selected, and then click OK.
5. In the Windows Components Wizard, click Next to start Windows 2000 Setup. Insert the Windows 2000 Advanced Server CD-ROM into the CD-ROM drive if you are prompted to do so. Setup copies the DHCP server and tool files to your computer.
6. When Setup is complete, click Finish.

Configuring the DHCP Service

After you install and start the DHCP service, you must create a scope. Each DHCP server in your environment should have at least one scope that does not overlap with any other DHCP server scope in your environment. In Windows 2000, DHCP servers within an Active Directory domain environment must be authorized to prevent rogue DHCP servers from coming online and authorizing a DHCP Server.

When you install and configure the DHCP service on a domain controller, the server is typically authorized the first time that you add the server to the DHCP console. However, when you install and configure the DHCP service on a member server, you need to authorize the DHCP server.

Note A stand-alone DHCP server cannot be authorized against an existing Windows Active Directory.

To authorize a DHCP server:

1. Click Start, click Programs, click Administrative Tools, and then click DHCP.
   
2. In the console tree of the DHCP snap-in, select the new DHCP server. If there is a red arrow in the bottom-right corner of the server object, the server has not yet been authorized.
3. Right-click the server, and then click Authorize.
4. After a few moments, right-click the server again and then click Refresh. The server should display a green arrow in the bottom-right corner to indicate that the server has been authorized.

To create a new scope:

1. Click Start, click Programs, point to Administrative Tools, and then click DHCP.
2. Right-click the server, and then click New Scope. In the New Scope Wizard, click Next, and then type a name and description for the scope. This can be any name that you choose, but it should be descriptive enough to identify the purpose of the scope on your network. For example, you might use Administration Building Client Addresses.
3. Type the range of addresses that can be leased as part of this scope, for example, a starting IP address of 192.168.100.1 to an ending address of 192.168.100.100. Because these addresses are given to clients, they should all be valid addresses for your network and not currently in use. If you want to use a different subnet mask, type the new subnet mask. Click Next.
4. Type any IP addresses that you want to exclude from the range you entered. This includes any addresses that may have already been statically assigned to various computers in your organization. Click Next.
5. Type the number of days, hours, and minutes before an IP address lease from this scope expires. This determines the length of time that a client can hold a leased address without renewing it. Click Next to select Yes, I want to configure these options now, and then extend the wizard to include settings for the most common DHCP options. Click Next.
6. Type the IP address for the default gateway that should be used by clients that obtain an IP address from this scope. Click Add to place the default gateway address into the list, and then click Next.
7. Click Yes, I want to activate this scope now, to activate the scope and allow clients to obtain leases from it, and then click Next. Click Finish.

Source: http://support.microsoft.com/kb/300429

Using dnsmasq for DNS and DHCP services

Software for providing DNS and DHCP services have typically come from ISC in the form of BIND and dhcpd.

While these software packages are quite robust and, for the most part, quite secure, there are other alternatives that may work better depending on your situation. For smaller home or office networks, managing BIND and dhcpd may be overkill.

Another solution that provides both services is dnsmasq, which will cache external DNS addresses, provide local DNS names or override external DNS entries, and also provides dynamic IP addresses in the form of DHCP.

It can even provide static IP addresses over DHCP, the same as dhcpd, with the only pre-requisite being the MAC address of the system to assign the static IP to.

Most Linux distributions come with dnsmasq packaged, so it is a simple apt-get, yum, or urpmi away. Otherwise, compiling from source is quite easy. Dnsmasq handles DNS setup differently than BIND and other DNS servers. Everything is configured via a single configuration file, /etc/dnsmasq.conf.

When a request comes in, dnsmasq does not look in zone or similar files; it consults /etc/hosts first and then will look externally for addresses by consulting the name server(s) defined in /etc/resolv.conf. This is a quick and easy way to override external DNS addresses by simply defining them in /etc/hosts on the system that is running dnsmasq.

Dnsmasq also provides DHCP services quite easily. To do so, uncomment and set the following options in /etc/dnsmasq.conf:

expand-hosts

domain=example.com

dhcp-range=192.168.0.50,192.168.0.150,12h

dhcp-option=3,192.168.0.1

This will enable DHCP and set the network domain to "example.com". The DHCP server will offer addresses between 192.168.0.50 and 192.168.0.150 with a lease of 12 hours. Finally, dhcp-option sets the third DHCP option, which sets the default route, pointing to 192.168.0.1 as the router.

There are a lot of dhcp-option values; the configuration file and man pages go through them all with examples.

To set a static IP address for a client, use the dhcp-host keyword:

dhcp-host=11:22:33:44:55:66,foo,192.168.0.10

This will always give the host with the hardware MAC address of 11:22:33:44:55:66 the hostname foo (.example.com) and the IP address 192.168.0.10.

Another useful feature of dnsmasq is that it provides a TFTP server as well. You can enable the TFTP server, point it to the root directory of files to serve, and make use of network booting (PXE).

Dnsmasq provides a number of features that make it a compelling replacement for BIND and dhcpd, or any other DNS or DHCP server software you may be using. It can set default MX records, various caching options, a wide variety of DHCP options, SRV records to provide LDAP information, PTR records, SPF records, and even Zeroconf records.

Source: http://www.zdnetasia.com/techguide/opensource/0,39044899,62048842,00.htm

Using dnsmasq for DNS and DHCP services

Software for providing DNS and DHCP services have typically come from ISC in the form of BIND and dhcpd. While these software packages are quite robust and, for the most part, quite secure, there are other alternatives that may work better depending on your situation. For smaller home or office networks, managing BIND and dhcpd may be overkill.

Another solution that provides both services is dnsmasq, which will cache external DNS addresses, provide local DNS names or override external DNS entries, and also provides dynamic IP addresses in the form of DHCP. It can even provide static IP addresses over DHCP, the same as dhcpd, with the only pre-requisite being the MAC address of the system to assign the static IP to.

Most Linux distributions come with dnsmasq packaged, so it is a simple apt-get, yum, or urpmi away. Otherwise, compiling from source is quite easy. Dnsmasq handles DNS setup differently than BIND and other DNS servers. Everything is configured via a single configuration file, /etc/dnsmasq.conf.

When a request comes in, dnsmasq does not look in zone or similar files; it consults /etc/hosts first and then will look externally for addresses by consulting the name server(s) defined in /etc/resolv.conf. This is a quick and easy way to override external DNS addresses by simply defining them in /etc/hosts on the system that is running dnsmasq.

Dnsmasq also provides DHCP services quite easily. To do so, uncomment and set the following options in /etc/dnsmasq.conf:

expand-hosts

domain=example.com

dhcp-range=192.168.0.50,192.168.0.150,12h

dhcp-option=3,192.168.0.1

This will enable DHCP and set the network domain to “example.com.” The DHCP server will offer addresses between 192.168.0.50 and 192.168.0.150 with a lease of 12 hours. Finally, dhcp-option sets the third (3) DHCP option, which sets the default route, pointing to 192.168.0.1 as the router. There are a lot of dhcp-option values; the configuration file and man pages go through them all with examples.

To set a static IP address for a client, use the dhcp-host keyword:

dhcp-host=11:22:33:44:55:66,foo,192.168.0.10

This will always give the host with the hardware MAC address of 11:22:33:44:55:66 the hostname foo (.example.com) and the IP address 192.168.0.10.

Another useful feature of dnsmasq is that it provides a TFTP server as well. You can enable the TFTP server, point it to the root directory of files to serve, and make use of network booting.

Dnsmasq provides a number of features that make it a compelling replacement for BIND and dhcpd, or any other DNS or DHCP server software you may be using. It can set default MX records, various caching options, a wide variety of DHCP options, SRV records to provide LDAP information, PTR records, SPF records, and even Zeroconf records.

For small office and home networks, dnsmasq is hard to beat in terms of simplicity and power. The configuration file is loaded with examples and information so, while initial setup for a larger network will require a commitment of some time, it is all very straightforward.

Get the PDF version of this tip here.

Source: blogs.techrepublic.com.com/opensource/?p=293

Manage Windows Server 2008 DHCP Servers From Command Line

Installing the DHCP Feature from the Command Line

A Windows Server 2008 system can only act as a DHCP server if the DHCP feature has been installed. This can be achieved from the command prompt using the servermanagercmd utility as follows:

servermanagercmd -install dhcp

[edit] Authorizing DHCP Servers in Active Directory

If a DHCP server is to operate within an Active Directory domain (and is not running on a domain controller) it must first be authorized. This can be achieved either as part of the DHCP Server role installation, or subsequently using either DHCP console or at the command prompt using the netsh tool. To achieve this, open a command prompt and enter the following command:

netsh dhcp server serverID initiate auth

In the above command syntax, serverID is replaced by the IP address or full UNC name of system on which the DHCP server is installed.
[edit] Configuring Scopes at the Command Prompt

DHCP scopes may be configured from the command prompt using the netsh tool. netsh may be run as a single command, or interactively. To run interactively. To run in interactive mode follow these steps:

1. At the command prompt enter netsh.
2. At the netsh> prompt enter dhcp.
3. At the netsh dhcp> prompt enter server \\servername where servername is the UNC name or IP address of the server to be managed. For example:
4. netsh dhcp>server \\winserver-1
5. At the netsh dhcp server prompt, enter the commands to be executed.

Alternatively, run each netsh command separately, using the following syntax:

netsh dhcp server \\servername commands

To create a new DHCP scope the command syntax is as follows:

netsh dhcp server \\servername scope subnetID add iprange startIP endIP

For example, to create a scope on subnet 192.168.2.0 ranging from 192.168.2.1 through 192.168.2.100:

netsh dhcp server \\winserver-1 scope 192.168.2.0 add iprange 192.168.2.1
192.168.2.100

Changed the current scope context to 192.168.2.0 scope.

Command completed successfully.

To list a scope IP address range:

netsh dhcp server \\winserver-1 scope 192.168.2.0 show iprange

Changed the current scope context to 192.168.2.0 scope.

=========================================================
Start Address - End Address - Address type
=========================================================
192.168.2.1 - 192.168.2.100 - DHCP ONLY

Number of IP Ranges : 1 in the Scope : 192.168.2.0.

Command completed successfully.

To delete a scope using netsh:

netsh dhcp server \\winserver-1 scope 192.168.2.0 delete iprange 192.168.2.1
192.168.2.100

Changed the current scope context to 192.168.2.0 scope.

Command completed successfully.

To display the current state of a scope:

netsh dhcp server \\winserver-1 scope 192.168.2.0 show state

Changed the current scope context to 192.168.2.0 scope.

Current State of the Scope 192.168.2.0 : Active

Command completed successfully.

To add an exclude range to a scope:

netsh dhcp server \\winserver-1 scope 192.168.2.0 add excluderange
192.168.2.10 192.168.2.20

Changed the current scope context to 192.168.2.0 scope.

Command completed successfully.

To display an exclude ranges:

netsh dhcp server \\winserver-1 scope 192.168.2.0 show excluderange

Changed the current scope context to 192.168.2.0 scope.

=====================================
Start Address - End Address
=====================================
192.168.2.10 - 192.168.2.20

Number of ExcludeRanges : 1 in the Scope : 192.168.2.0.

Command completed successfully.

To list the clients using a DHCP scope:

netsh dhcp server \\winserver-1 scope 192.168.2.0 show clients

Changed the current scope context to 192.168.2.0 scope.

Type : N - NONE, D - DHCP B - BOOTP, U - UNSPECIFIED, R - RESERVATION IP
==================================================================================
IP Address - Subnet Mask - Unique ID - Lease Expires -Type
==================================================================================


No of Clients(version 4): 0 in the Scope : 192.168.2.0.

Command completed successfully.

[edit] Activating and Deactivating DHCP Scopes using Netsh

DHCP scopes must be activated before they can be used and may also be deactivated at any time. Both of these tasks may be performed at the command prompt using the 'netsh tool. For example, to activate a scope the following command line syntax is used:

netsh dhcp server serverID scope subnetID state status

where serverID is the name or IP address of the computer running the DHCP server, subnetID is the network ID of the subnet on which the scope is to be configured, and status is either 1 or 0 depending on whether the scope is to activated (1) or deactivated (0). On a switched network with multiple virtual networks are hosts on a single network use 2 and 3 respectively to deactivate and activate the scope.
[edit] Terminating a DHCP Lease using Netsh

The lease associated with an IP address may be terminated at the command prompt using the following command syntax:

netsh dhcp server serverID scope subnetID delete lease IPaddress

where serverID is the name or IP address of the computer running the DHCP server, subnetID is the network ID of the subnet on which the IP address resides, and IPaddress is the IP address on which the lease is to be terminated. For example,

netsh dhcp server \\winserver-1 scope 192.168.2.0 delete lease 192.168.2.101

[edit] Configuring DHCP Reservations using Netsh

DHCP reservations provide a mechanism by which IP addresses may be permanently assigned to a specific client based on the MAC address of that client.

The MAC address of a Windows client can be found running the ipconfig /all command. For Linux systems the corresponding command is ifconfig -a. Once the MAC address has been identified, the reservation may be configured using either the DHCP console or at the command prompt using the netsh tool.

To add a reservation using netsh the following syntax is used:

netsh dhcp server \\servername scope subnetID add reservedip IPaddress MacAddress ReservationName Comment

For example the following command reserves an IP address for a specific MAC address (note that the MAC address must be entered without any delimiters):

C:\Users\Administrator>netsh dhcp server \\winserver-2 scope 192.168.2.0 add reservedip
192.168.2.12 0013720B1457 "CEO Printer" "Printer in Exec Suite"

Changed the current scope context to 192.168.2.0 scope.

Command completed successfully.

To list the current reserved IP addresses for a particular scope the following netsh command may be used:

C:\Users\Administrator>netsh dhcp server \\winserver-2 scope 192.168.2.0 show
reservedip

Changed the current scope context to 192.168.2.0 scope.

===============================================================
Reservation Address - Unique ID
===============================================================

192.168.2.10 - 00-0b-db-18-a0-db-
192.168.2.11 - 06-ec-e6-11-47-bd-
192.168.2.12 - 00-13-72-0b-14-57-


No of ReservedIPs : 3 in the Scope : 192.168.2.0.

Command completed successfully.

[edit] Configuring DHCP Conflist Detection

By default, if a DHCP server assigns an IP address to a client which conficts with another client, it is the job of the client to decline the assigned address and request that the DHCP server send another. A faster option is to enable DHCP Conflict Detection on the DHCP server, whereby the server checks that there are no conflicts associated with an IP address before it is assigned to a client. The DHCP server will repeat this process until a valid IP address is found, or a specified number of attempts to find a non-conflicting IP address is reached. The syntax to enable conflict detection and specify the number of retry attempts is as follows:

netsh dhcp server servername set detectionconflictretry no_of_attempts

where servername is the name or IP address of the DHCP server and no_of_attempts is the maximum number of times the DHCP server will attempt to find a non-conflicting IP address. To disable confict detection simpy run the above command setting no_of_attempts to 0. For example:

netsh dhcp server \\winserver-1 set detectionconflictretry 0

[edit] Backing Up and Restoring DHCP Configuration Information

The current configuration of a DHCP server can quickly and easily be saved and restored using the dump option of the netsh tool. This enables a server to be quickly restored to its original state in the case of a system failure, or for the configuration to be duplicated on another server.

For example, to back up the configuration on a local server to a file named DHCPconfig.cfg:

netsh dhcp server dump > DHCPconfig.cfg

The configuration on a remote system may be similarly saved by specifying the name or IP address of the server:

netsh dhcp server winserver-1 dump > DHCPconfig.cfg

Source:techotopia.com/index.php/Managing_a_Windows_Server_2008_DHCP_Server_from_the_Command_Line

DHCP Server Security

Although DHCP servers are critical to the operation of most enterprise networks, DHCP server security is often one of the most overlooked areas of network security. One reason for this might be the simplicity of how DHCP works: DHCP clients broadcast discovery messages (DHCPDISCOVER) containing their MAC addresses and DHCP servers respond by offering (DHCPOFFER) to lease an IP address and other TCP/IP settings that the client can use to communicate on the network. The client responds (DHCPREQUEST) to the first lease offer it receives and the server acknowledges (DHCPACK) the request and marks the address as leased in its DHCP database. That's all there is to it—who needs to worry about security?

Attacking DHCP

Unfortunately it's the very simplicity of DHCP that's actually the problem as far as security goes. No authentication or authorization takes place during an exchange between a DHCP server and DCHP client, so the server has no way of knowing if the client requesting the address is a legitimate client on the network, and the client has no way of knowing if the server that assigned the address is a legitimate DHCP server. The possibility of rogue clients and servers on your network can create all kinds of problems.

For example, a rogue DHCP server could provide legitimate clients with bogus TCP/IP information that prevents the clients from communicating on the network. A denial of service (DoS) condition then results, and users are unable to connect to network resources to perform their work. Setting up a rogue DHCP server could be as simple as conducting a social engineering attack to gain physical access to your network and plugging in a laptop configured as a DHCP server.

Another scenario might involve an attacker compromising a client computer on your network and installing software that repeatedly requests new IP addresses using spoofed MAC addresses until the entire pool of addresses in your DHCP server's scope is leased. When this happens, legitimate clients that boot onto the network can't acquire an address and again users are unable to access the network and can't do their work.

A more sinister result happens when an attacker breaches network security and gains control of your own DHCP servers. At that point the attacker might proceed to modify the DHCP server to assign clients an incorrect subnet setting and thus create another DoS condition. Or they might modify the server to assign clients incorrect DNS settings and redirect clients to rogue or hijacked DNS servers, which could then redirect clients to hostile websites where they unknowingly download a trojan.

Worse yet, if you're running your DHCP server on a domain controller then an attacker who compromises your DHCP server gains access to your accounts database and can cause all sorts of further problems. The result is usually your worst nightmare. Fortunately, there are some measures you can take to protect your DHCP servers and avoid many of these scenarios, provided you're also following all the usual best practices for securing Windows-based networks. Let's look at some specific threats to DHCP on your network and the countermeasures you can take to mitigate these different threats.

Threats and Countermeasures

On the face of it, the requirement that Windows 2000 and Windows Server 2003 DHCP servers be authorized in Active Directory before they can start leasing addresses to requesting clients seems to mitigate the threat of rogue DHCP servers on your network. Authorization means that when a Windows 2000 or Windows Server 2003 DHCP server boots onto an Active Directory network it first contacts a domain controller to check if its own IP address is found on the list of authorized DHCP servers maintained by the domain controller. If the DHCP server determines that it is authorized to lease addresses to clients, it begins to do so. If it's not authorized, Windows shuts down the DHCP Server service on the machine so it won't be able to lease addresses.

The real benefit of this is to protect your network against legitimate DHCP servers that are badly configured, though it has the added side effect of guarding against accidental or rogue DHCP servers running Windows 2000 or Windows Server 2003. What happens though if an attacker compromises your network with a rogue DHCP server not running Windows 2000 or Windows Server 2003? In this case authorization won't help because non-Microsoft DHCP servers may not respond the same way as Microsoft ones to the DHCPINFORM messages Windows uses to check if DHCP servers are authorized.

Rogue clients is another problem entirely though, as DHCP is designed to make it easy for clients to obtain IP addresses so they can participate on a network. The obvious way of dealing with the problem of rogue clients would seem at first to be DHCP reservation, though on large networks this entails considerable administrative overhead. A reservation is a predefined setting that maps a MAC address to an IP address so that only a client with a particular MAC address can lease the IP address associated with that reservation. If security is critical an administrator could create reservations for each and every client machine on the network, and if unreserved IP addresses still remain in the DHCP server's cope then these could be reserved using invalid or non-existing MAC addresses. Then when a rogue client tries to boot on the network the result is that the DHCP server has no free addresses to lease and the client can't connect.

If only it were that simple. While this approach might foil a casual attack, sophisticated attackers have ways for circumventing DHCP reservations. The simplest approach is for the attacker to run a program that listens for DHCPDISCOVER broadcasts from clients and harvests their MAC addresses. Then when a legitimate client shuts down the rogue client can reconfigure its MAC address to match that of the legitimate client and hijack the legitimate client's lease or try to disrupt communications for the client. Considering this, security-conscious administrators might consider dropping DHCP entirely in favor of static addressing, but what's to stop an attacker who has physical access to your network from assigning a static address to their own machine and joining the network?

Via:windowsecurity.com/articles/DHCP-Security-Part1.html