(OK-HALF) To Find a Rogue DHCP Server—tcpdump/dhclient—nmap

转载

https://www.cnblogs.com/ztguang/p/12646990.html

# . find_rogue_dhcp.sh &




    #! /bin/sh
    # tcpdump -i enp13s0 -nev udp port 68 >> /tmp/rogue 2>&1 &
    # touch /tmp/rogue_dhcp_ip
    # . find_rogue_dhcp.sh &

    while true
    do
    echo > /tmp/rogue
    dhclient -r
    dhclient >/dev/null 2>&1
    sleep 2
    grep '192.168' /tmp/rogue >> /tmp/rogue_dhcp_ip
    done

nmap -sP 10.108.160.0/22
tcpdump -i enp13s0 -nev  >> /tmp/rogue

++++++++++++++
Rogue DHCP Server MAC:  c8:3a:35:11:70:00

All mac addresses starting with C8-3A-35 belong to the owner Tenda Technology Co.,

++++++++++++++

tcpdump -i enp13s0 -nev udp port 68 >> /tmp/rogue 2>&1 &
arping -i eth1 00:E0:29:XX:YY:ZZ
nmap -sP 192.168.0.0/24 >/dev/null && arp -an | grep c8:3a:35:11:70:00 | awk '{print $2}' | sed 's/[()]//g'

++++++++++++++ Tenda MAC address list
Vendor: TendaTec Mac address: C8:3A:35

++++++++++++++ TP-Link MAC address list
Vendor: Tp-LinkT Mac address: 00:19:E0
Vendor: Tp-LinkT Mac address: 00:1D:0F
Vendor: Tp-LinkT Mac address: 00:21:27
Vendor: Tp-LinkT Mac address: 00:23:CD
Vendor: Tp-LinkT Mac address: 00:25:86
Vendor: Tp-LinkT Mac address: 00:27:19
Vendor: Tp-LinkT Mac address: 40:16:9F
Vendor: Tp-LinkT Mac address: 54:E6:FC
Vendor: Tp-LinkT Mac address: 74:EA:3A
Vendor: Tp-LinkT Mac address: 94:0C:6D
Vendor: Tp-LinkT Mac address: B0:48:7A
Vendor: Tp-LinkT Mac address: D8:5D:4C
Vendor: Tp-LinkT Mac address: E0:05:C5
Vendor: Tp-LinkT Mac address: F4:EC:38


++++++++++++++++++++++++++++

+++++++++++++++++++异常

[root@localhost core]# tcpdump -i enp13s0 -nev udp port 68

tcpdump: listening on enp13s0, link-type EN10MB (Ethernet), capture size 65535 bytes
08:56:13.405651 3c:97:0e:f0:b5:bb > c8:3a:35:11:70:00, ethertype IPv4 (0x0800), length 342: (tos 0x0, ttl 64, id 56976, offset 0, flags [DF], proto UDP (17), length 328)
    192.168.0.111.bootpc > 192.168.0.1.bootps: BOOTP/DHCP, Request from 3c:97:0e:f0:b5:bb, length 300, xid 0x292e3d42, Flags [none]
      Client-IP 192.168.0.111
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Release
        Server-ID Option 54, length 4: 192.168.0.1
08:56:23.516772 3c:97:0e:f0:b5:bb > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0x10, ttl 128, id 0, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 3c:97:0e:f0:b5:bb, length 300, xid 0xb5d8ea1c, Flags [none]
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Discover
        Requested-IP Option 50, length 4: 192.168.0.111
        Parameter-Request Option 55, length 13:
          Subnet-Mask, BR, Time-Zone, Classless-Static-Route
          Domain-Name, Domain-Name-Server, Hostname, YD
          YS, NTP, MTU, Option 119
          Default-Gateway
08:56:23.526530 c8:3a:35:11:70:00 > 3c:97:0e:f0:b5:bb, ethertype IPv4 (0x0800), length 590: (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto UDP (17), length 576)
    192.168.0.1.bootps > 192.168.0.111.bootpc: BOOTP/DHCP, Reply, length 548, xid 0xb5d8ea1c, Flags [none]
      Your-IP 192.168.0.111
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Offer
        Server-ID Option 54, length 4: 192.168.0.1
        Lease-Time Option 51, length 4: 86400
        Subnet-Mask Option 1, length 4: 255.255.255.0
        Default-Gateway Option 3, length 4: 192.168.0.1
        Domain-Name-Server Option 6, length 8: 192.168.0.1,192.168.0.1
        MTU Option 26, length 2: 1500
08:56:23.526667 3c:97:0e:f0:b5:bb > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0x10, ttl 128, id 0, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 3c:97:0e:f0:b5:bb, length 300, xid 0xb5d8ea1c, Flags [none]
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Request
        Server-ID Option 54, length 4: 192.168.0.1
        Requested-IP Option 50, length 4: 192.168.0.111
        Parameter-Request Option 55, length 13:
          Subnet-Mask, BR, Time-Zone, Classless-Static-Route
          Domain-Name, Domain-Name-Server, Hostname, YD
          YS, NTP, MTU, Option 119
          Default-Gateway
08:56:23.536296 00:0f:e2:6a:09:78 > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0xe0, ttl 255, id 12000, offset 0, flags [none], proto UDP (17), length 328)
    10.108.160.1.bootps > 255.255.255.255.bootpc: BOOTP/DHCP, Reply, length 300, hops 1, xid 0xb5d8ea1c, Flags [Broadcast]
      Gateway-IP 10.108.160.1
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: NACK
        Server-ID Option 54, length 4: 10.3.9.2
        MSG Option 56, length 31: "requested address not available"
08:56:23.537153 00:0f:e2:6a:09:78 > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0xe0, ttl 255, id 12001, offset 0, flags [none], proto UDP (17), length 328)
    10.108.160.1.bootps > 255.255.255.255.bootpc: BOOTP/DHCP, Reply, length 300, hops 1, xid 0xb5d8ea1c, Flags [Broadcast]
      Gateway-IP 10.108.160.1
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: NACK
        Server-ID Option 54, length 4: 10.3.9.31
        MSG Option 56, length 31: "requested address not available"
08:56:23.550490 c8:3a:35:11:70:00 > 3c:97:0e:f0:b5:bb, ethertype IPv4 (0x0800), length 590: (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto UDP (17), length 576)
    192.168.0.1.bootps > 192.168.0.111.bootpc: BOOTP/DHCP, Reply, length 548, xid 0xb5d8ea1c, Flags [none]
      Your-IP 192.168.0.111
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: ACK
        Server-ID Option 54, length 4: 192.168.0.1
        Lease-Time Option 51, length 4: 86400
        Subnet-Mask Option 1, length 4: 255.255.255.0
        Default-Gateway Option 3, length 4: 192.168.0.1
        Domain-Name-Server Option 6, length 8: 192.168.0.1,192.168.0.1
        MTU Option 26, length 2: 1500
08:56:23.961106 3c:97:0e:f0:b5:bb > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0x10, ttl 128, id 0, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 3c:97:0e:f0:b5:bb, length 300, xid 0x2bdda24d, Flags [none]
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Discover
        Parameter-Request Option 55, length 13:
          Subnet-Mask, BR, Time-Zone, Classless-Static-Route
          Domain-Name, Domain-Name-Server, Hostname, YD
          YS, NTP, MTU, Option 119
          Default-Gateway
08:56:23.970519 c8:3a:35:11:70:00 > 3c:97:0e:f0:b5:bb, ethertype IPv4 (0x0800), length 590: (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto UDP (17), length 576)
    192.168.0.1.bootps > 192.168.0.111.bootpc: BOOTP/DHCP, Reply, length 548, xid 0x2bdda24d, Flags [none]
      Your-IP 192.168.0.111
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Offer
        Server-ID Option 54, length 4: 192.168.0.1
        Lease-Time Option 51, length 4: 86400
        Subnet-Mask Option 1, length 4: 255.255.255.0
        Default-Gateway Option 3, length 4: 192.168.0.1
        Domain-Name-Server Option 6, length 8: 192.168.0.1,192.168.0.1
        MTU Option 26, length 2: 1500
08:56:23.970708 3c:97:0e:f0:b5:bb > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0x10, ttl 128, id 0, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 3c:97:0e:f0:b5:bb, length 300, xid 0x2bdda24d, Flags [none]
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Request
        Server-ID Option 54, length 4: 192.168.0.1
        Requested-IP Option 50, length 4: 192.168.0.111
        Parameter-Request Option 55, length 13:
          Subnet-Mask, BR, Time-Zone, Classless-Static-Route
          Domain-Name, Domain-Name-Server, Hostname, YD
          YS, NTP, MTU, Option 119
          Default-Gateway
08:56:23.979893 00:0f:e2:6a:09:78 > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0xe0, ttl 255, id 12006, offset 0, flags [none], proto UDP (17), length 328)
    10.108.160.1.bootps > 255.255.255.255.bootpc: BOOTP/DHCP, Reply, length 300, hops 1, xid 0x2bdda24d, Flags [Broadcast]
      Gateway-IP 10.108.160.1
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: NACK
        Server-ID Option 54, length 4: 10.3.9.31
        MSG Option 56, length 31: "requested address not available"
08:56:23.980828 00:0f:e2:6a:09:78 > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0xe0, ttl 255, id 12007, offset 0, flags [none], proto UDP (17), length 328)
    10.108.160.1.bootps > 255.255.255.255.bootpc: BOOTP/DHCP, Reply, length 300, hops 1, xid 0x2bdda24d, Flags [Broadcast]
      Gateway-IP 10.108.160.1
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: NACK
        Server-ID Option 54, length 4: 10.3.9.2
        MSG Option 56, length 31: "requested address not available"
08:56:23.994474 c8:3a:35:11:70:00 > 3c:97:0e:f0:b5:bb, ethertype IPv4 (0x0800), length 590: (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto UDP (17), length 576)
    192.168.0.1.bootps > 192.168.0.111.bootpc: BOOTP/DHCP, Reply, length 548, xid 0x2bdda24d, Flags [none]
      Your-IP 192.168.0.111
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: ACK
        Server-ID Option 54, length 4: 192.168.0.1
        Lease-Time Option 51, length 4: 86400
        Subnet-Mask Option 1, length 4: 255.255.255.0
        Default-Gateway Option 3, length 4: 192.168.0.1
        Domain-Name-Server Option 6, length 8: 192.168.0.1,192.168.0.1
        MTU Option 26, length 2: 1500
08:56:24.525846 00:0f:e2:6a:09:78 > 3c:97:0e:f0:b5:bb, ethertype IPv4 (0x0800), length 349: (tos 0xe0, ttl 255, id 12032, offset 0, flags [none], proto UDP (17), length 335)
    10.108.160.1.bootps > 10.108.162.164.bootpc: BOOTP/DHCP, Reply, length 307, hops 1, xid 0xb5d8ea1c, Flags [none]
      Your-IP 10.108.162.164
      Gateway-IP 10.108.160.1
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Offer
        Server-ID Option 54, length 4: 10.3.9.2
        Lease-Time Option 51, length 4: 6878
        Subnet-Mask Option 1, length 4: 255.255.252.0
        BR Option 28, length 4: 10.108.163.255
        Domain-Name Option 15, length 11: "bupt.edu.cn"
        Domain-Name-Server Option 6, length 12: 10.3.9.4,10.3.9.5,10.3.9.6
        NTP Option 42, length 4: 10.3.9.9
        Default-Gateway Option 3, length 4: 10.108.160.1

+++++++++++++++++++++++++++++++
[root@localhost core]# tcpdump -i enp13s0 -nev udp port 68 >> /tmp/rogue 2>&1 &
[root@localhost core]# cat /tmp/rogue
[root@localhost core]# tcpdump -i enp13s0 -nev udp port 68

tcpdump: WARNING: enp13s0: no IPv4 address assigned
tcpdump: listening on enp13s0, link-type EN10MB (Ethernet), capture size 65535 bytes
08:57:50.318066 74:27:ea:ac:07:52 > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0x0, ttl 64, id 9019, offset 0, flags [none], proto UDP (17), length 328)
    10.108.163.64.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 74:27:ea:ac:07:52, length 300, xid 0x460dbace, Flags [none]
      Client-IP 10.108.163.64
      Client-Ethernet-Address 74:27:ea:ac:07:52
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Inform
        Client-ID Option 61, length 7: ether 74:27:ea:ac:07:52
        Hostname Option 12, length 12: "xiaoyifei-PC"
        Vendor-Class Option 60, length 8: "MSFT 5.0"
        Parameter-Request Option 55, length 13:
          Subnet-Mask, Domain-Name, Default-Gateway, Domain-Name-Server
          Netbios-Name-Server, Netbios-Node, Netbios-Scope, Router-Discovery
          Static-Route, Classless-Static-Route, Classless-Static-Route-Microsoft, Vendor-Option
          Option 252
08:57:50.733654 3c:97:0e:f0:b5:bb > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0x10, ttl 128, id 0, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 3c:97:0e:f0:b5:bb, length 300, xid 0xbdc7c05e, Flags [none]
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Discover
        Requested-IP Option 50, length 4: 192.168.0.111
        Parameter-Request Option 55, length 13:
          Subnet-Mask, BR, Time-Zone, Classless-Static-Route
          Domain-Name, Domain-Name-Server, Hostname, YD
          YS, NTP, MTU, Option 119
          Default-Gateway
08:57:50.742946 c8:3a:35:11:70:00 > 3c:97:0e:f0:b5:bb, ethertype IPv4 (0x0800), length 590: (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto UDP (17), length 576)
    192.168.0.1.bootps > 192.168.0.111.bootpc: BOOTP/DHCP, Reply, length 548, xid 0xbdc7c05e, Flags [none]
      Your-IP 192.168.0.111
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Offer
        Server-ID Option 54, length 4: 192.168.0.1
        Lease-Time Option 51, length 4: 86400
        Subnet-Mask Option 1, length 4: 255.255.255.0
        Default-Gateway Option 3, length 4: 192.168.0.1
        Domain-Name-Server Option 6, length 8: 192.168.0.1,192.168.0.1
        MTU Option 26, length 2: 1500
08:57:50.743076 3c:97:0e:f0:b5:bb > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0x10, ttl 128, id 0, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 3c:97:0e:f0:b5:bb, length 300, xid 0xbdc7c05e, Flags [none]
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Request
        Server-ID Option 54, length 4: 192.168.0.1
        Requested-IP Option 50, length 4: 192.168.0.111
        Parameter-Request Option 55, length 13:
          Subnet-Mask, BR, Time-Zone, Classless-Static-Route
          Domain-Name, Domain-Name-Server, Hostname, YD
          YS, NTP, MTU, Option 119
          Default-Gateway
08:57:50.766898 c8:3a:35:11:70:00 > 3c:97:0e:f0:b5:bb, ethertype IPv4 (0x0800), length 590: (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto UDP (17), length 576)
    192.168.0.1.bootps > 192.168.0.111.bootpc: BOOTP/DHCP, Reply, length 548, xid 0xbdc7c05e, Flags [none]
      Your-IP 192.168.0.111
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: ACK
        Server-ID Option 54, length 4: 192.168.0.1
        Lease-Time Option 51, length 4: 86400
        Subnet-Mask Option 1, length 4: 255.255.255.0
        Default-Gateway Option 3, length 4: 192.168.0.1
        Domain-Name-Server Option 6, length 8: 192.168.0.1,192.168.0.1
        MTU Option 26, length 2: 1500
08:57:50.773417 00:0f:e2:6a:09:78 > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0xe0, ttl 255, id 14201, offset 0, flags [none], proto UDP (17), length 328)
    10.108.160.1.bootps > 255.255.255.255.bootpc: BOOTP/DHCP, Reply, length 300, hops 1, xid 0xbdc7c05e, Flags [Broadcast]
      Gateway-IP 10.108.160.1
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: NACK
        Server-ID Option 54, length 4: 10.3.9.31
        MSG Option 56, length 31: "requested address not available"
08:57:50.774332 00:0f:e2:6a:09:78 > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0xe0, ttl 255, id 14202, offset 0, flags [none], proto UDP (17), length 328)
    10.108.160.1.bootps > 255.255.255.255.bootpc: BOOTP/DHCP, Reply, length 300, hops 1, xid 0xbdc7c05e, Flags [Broadcast]
      Gateway-IP 10.108.160.1
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: NACK
        Server-ID Option 54, length 4: 10.3.9.2
        MSG Option 56, length 31: "requested address not available"
08:57:51.745699 00:0f:e2:6a:09:78 > 3c:97:0e:f0:b5:bb, ethertype IPv4 (0x0800), length 349: (tos 0xe0, ttl 255, id 14219, offset 0, flags [none], proto UDP (17), length 335)
    10.108.160.1.bootps > 10.108.162.164.bootpc: BOOTP/DHCP, Reply, length 307, hops 1, xid 0xbdc7c05e, Flags [none]
      Your-IP 10.108.162.164
      Gateway-IP 10.108.160.1
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Offer
        Server-ID Option 54, length 4: 10.3.9.2
        Lease-Time Option 51, length 4: 6791
        Subnet-Mask Option 1, length 4: 255.255.252.0
        BR Option 28, length 4: 10.108.163.255
        Domain-Name Option 15, length 11: "bupt.edu.cn"
        Domain-Name-Server Option 6, length 12: 10.3.9.4,10.3.9.5,10.3.9.6
        NTP Option 42, length 4: 10.3.9.9
        Default-Gateway Option 3, length 4: 10.108.160.1
08:57:58.891406 3c:97:0e:a6:bf:95 > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0x0, ttl 64, id 22516, offset 0, flags [none], proto UDP (17), length 328)
    10.108.162.31.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 3c:97:0e:a6:bf:95, length 300, xid 0x34f84154, Flags [none]
      Client-IP 10.108.162.31
      Client-Ethernet-Address 3c:97:0e:a6:bf:95
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Inform
        Client-ID Option 61, length 7: ether 3c:97:0e:a6:bf:95
        Hostname Option 12, length 3: "ytx"
        Vendor-Class Option 60, length 8: "MSFT 5.0"
        Parameter-Request Option 55, length 13:
          Subnet-Mask, Domain-Name, Default-Gateway, Domain-Name-Server
          Netbios-Name-Server, Netbios-Node, Netbios-Scope, Router-Discovery
          Static-Route, Classless-Static-Route, Classless-Static-Route-Microsoft, Vendor-Option
          Option 252

++++++++++++++++++++正常

[root@localhost core]# cat /tmp/rogue
tcpdump: listening on enp13s0, link-type EN10MB (Ethernet), capture size 65535 bytes
09:03:31.867877 3c:97:0e:f0:b5:bb > 00:0f:e2:6a:09:78, ethertype IPv4 (0x0800), length 342: (tos 0x0, ttl 64, id 32929, offset 0, flags [DF], proto UDP (17), length 328)
    10.108.162.164.bootpc > 192.168.0.1.bootps: BOOTP/DHCP, Request from 3c:97:0e:f0:b5:bb, length 300, xid 0x4d825b75, Flags [none]
      Client-IP 192.168.0.111
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Release
        Server-ID Option 54, length 4: 192.168.0.1
09:03:35.721679 3c:97:0e:f0:b5:bb > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0x10, ttl 128, id 0, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 3c:97:0e:f0:b5:bb, length 300, xid 0xf7a09f4e, Flags [none]
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Discover
        Requested-IP Option 50, length 4: 192.168.0.111
        Parameter-Request Option 55, length 13:
          Subnet-Mask, BR, Time-Zone, Classless-Static-Route
          Domain-Name, Domain-Name-Server, Hostname, YD
          YS, NTP, MTU, Option 119
          Default-Gateway
09:03:36.730560 00:0f:e2:6a:09:78 > 3c:97:0e:f0:b5:bb, ethertype IPv4 (0x0800), length 349: (tos 0xe0, ttl 255, id 23033, offset 0, flags [none], proto UDP (17), length 335)
    10.108.160.1.bootps > 10.108.162.164.bootpc: BOOTP/DHCP, Reply, length 307, hops 1, xid 0xf7a09f4e, Flags [none]
      Your-IP 10.108.162.164
      Gateway-IP 10.108.160.1
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Offer
        Server-ID Option 54, length 4: 10.3.9.2
        Lease-Time Option 51, length 4: 6446
        Subnet-Mask Option 1, length 4: 255.255.252.0
        BR Option 28, length 4: 10.108.163.255
        Domain-Name Option 15, length 11: "bupt.edu.cn"
        Domain-Name-Server Option 6, length 12: 10.3.9.4,10.3.9.5,10.3.9.6
        NTP Option 42, length 4: 10.3.9.9
        Default-Gateway Option 3, length 4: 10.108.160.1
09:03:36.730688 3c:97:0e:f0:b5:bb > Broadcast, ethertype IPv4 (0x0800), length 342: (tos 0x10, ttl 128, id 0, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 3c:97:0e:f0:b5:bb, length 300, xid 0xf7a09f4e, Flags [none]
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: Request
        Server-ID Option 54, length 4: 10.3.9.2
        Requested-IP Option 50, length 4: 10.108.162.164
        Parameter-Request Option 55, length 13:
          Subnet-Mask, BR, Time-Zone, Classless-Static-Route
          Domain-Name, Domain-Name-Server, Hostname, YD
          YS, NTP, MTU, Option 119
          Default-Gateway
09:03:36.741608 00:0f:e2:6a:09:78 > 3c:97:0e:f0:b5:bb, ethertype IPv4 (0x0800), length 349: (tos 0xe0, ttl 255, id 23037, offset 0, flags [none], proto UDP (17), length 335)
    10.108.160.1.bootps > 10.108.162.164.bootpc: BOOTP/DHCP, Reply, length 307, hops 1, xid 0xf7a09f4e, Flags [none]
      Your-IP 10.108.162.164
      Gateway-IP 10.108.160.1
      Client-Ethernet-Address 3c:97:0e:f0:b5:bb
      Vendor-rfc1048 Extensions
        Magic Cookie 0x63825363
        DHCP-Message Option 53, length 1: ACK
        Server-ID Option 54, length 4: 10.3.9.2
        Lease-Time Option 51, length 4: 6445
        Subnet-Mask Option 1, length 4: 255.255.252.0
        BR Option 28, length 4: 10.108.163.255
        Domain-Name Option 15, length 11: "bupt.edu.cn"
        Domain-Name-Server Option 6, length 12: 10.3.9.4,10.3.9.5,10.3.9.6
        NTP Option 42, length 4: 10.3.9.9
        Default-Gateway Option 3, length 4: 10.108.160.1
09:03:36.742581 00:0f:e2:6a:09:78 > 3c:97:0e:f0:b5:bb, ethertype IPv4 (0x0800), length 349: (tos 0xe0, ttl 255, id 23038, offset 0, flags [none], proto UDP (17), length 335)
    10.108.160.1.bootps > 10.108.162.164.bootpc: BOOTP/DHCP, Reply, length 307, hops 1, xid 0xf7a09f4e, Flags [none]
      Your-IP 10.108.162.164
      Gatew[root@localhost core]#