1. 問題背景
不同品牌的交換機(jī)通過dhcp請求挟秤，獲取到不同的bootfile-name瞻讽。
2. 抓包分析
2.1. 抓包命令
tcpdump -n -s0 -i eth0 net 198.19 -w ./dhcp.pcap
2.2. 包分析
使用wireshark來分析數(shù)據(jù)包的內(nèi)容。這里只展示了部分信息筷频。
只分析 DHCP Discover 就可以蚌成。
- 銳捷交換機(jī)
使用： Option: (12) Host Name
...
Option: (53) DHCP Message Type (Discover)
Option: (61) Client identifier
Option: (12) Host Name
Length: 6
Host Name: Ruijie
Option: (55) Parameter Request List
Option: (255) End
Padding: 000000000000000000000000000000000000000000000000…
- 華為交換機(jī)
使用： Option: (60) Vendor class identifier
...
Option: (53) DHCP Message Type (Discover)
Option: (55) Parameter Request List
Option: (60) Vendor class identifier
Length: 15
Vendor class identifier: HUAWEI CE5855EI
Option: (61) Client identifier
Option: (255) End
- 華三交換機(jī)
使用： Option: (60) Vendor class identifier
...
Option: (53) DHCP Message Type (Discover)
Option: (55) Parameter Request List
Option: (57) Maximum DHCP Message Size
Option: (60) Vendor class identifier
Length: 19
Vendor class identifier: H3C. H3C S6850-56HF
Option: (61) Client identifier
Option: (255) End
Padding: 0000000000000000
3. dhcp配置
group host_pool {
allow bootp;
allow booting;
default-lease-time 1800;
max-lease-time 2400;
#是的前痘，不是0,5.確實(shí)是0,6。代表前6個(gè)字符
if substring (option host-name, 0, 6) = "Ruijie" {
option tftp-server-name "192.168.1.254";
option bootfile-name "ruijie.py";
}
else if substring (option vendor-class-identifier, 0, 6) = "HUAWEI" {
option tftp-server-name "192.168.1.254";
option bootfile-name "huawei.py";
}
else if substring (option vendor-class-identifier, 0, 3) = "H3C" {
option tftp-server-name "192.168.1.254";
option bootfile-name "h3c.py";
}
else {
next-server 192.168.1.254;
filename "default.py";
}
#也可以匹配mac地址分析担忧，不同品牌的交換機(jī)芹缔，前三位的mac不一樣。不過此方法不太好
#if substring (hardware, 1, 3) = 00:74:9c {
# option tftp-server-name "192.168.1.254";
# option bootfile-name "ruijie.py";
#}
subnet 198.168.0.0 netmask 255.255.255.0 {option routers 198.168.0.254 ; range 198.168.0.151 198.168.0.169;}
}
