Dynamic Host Configuration Protocol (DHCP) is a network protocol that provides clients connected to a network to obtain TCP/IP configuration information (such as the private IP address) from a DHCP server.
A DHCP server (can be an access point, router, or configured in a server) dynamically assigns an IP address and other configuration parameters to each device connected to the network.
The DHCP protocol uses User Datagram Protocol (UDP) to perform the communication between the server and clients. It is implemented with two port numbers: UDP port number 67 for the server and UDP port number 68 for the client.
In this tutorial, we will make a simple DHCP listener using the Scapy library in Python. In other words, we'll be able to listen for DHCP packets in the network and extract valuable information whenever a device connects to the network we're in.
To get started, let's install Scapy:
$ pip install scapy
If you have trouble installing Scapy, I suggest you follow this tutorial if you're in Ubuntu or other similar distribution or Windows 10 here.
As you may already know, the sniff()
function in Scapy is responsible for sniffing any type of packet that can be monitored. Luckily, to remove other packets that we're not interested in, we simply use the filter parameter in the sniff()
function:
In the listen_dhcp()
function, we pass the print_packet()
function that we'll define as the callback that is executed whenever a packet is sniffed and matched by the filter.
To filter DHCP, we match UDP packets with port 67 or 68 in their attributes.