DHCP test client

While trying to set up my home network, I was dismayed that there was no simple way to test the DHCP server. Snooping packets is limited to examining existing traffic.

DHCP test tools exist (DHCPing and dhquery), however both are outdated and don’t work with the latest versions of their requirements, and both won’t work on Windows.

I’ve written a simple DHCP “client” which can receive and decode broadcasted DHCP replies, as well as send out DHCP “discover” packets. The tool is cross-platform, and should work on Windows and major POSIX systems.

Source, Windows binaries.

78 thoughts on “DHCP test client

  1. Allen Miller

    I just found your dhcptest.exe. I’m wondering if it would be difficult to expand it a little? I set the Option 66 on my DHCP server so IP phones can find their tftp server. The Option 66 just gets a text string which is a url. I would really like to be able to interrogate the server from a command line to test what string is being sent. Do you think that could be incorporated in your tool?

    Thanks.

    Regards,
    Allen

    Reply
    1. Aaron

      Great tool, I’m with you as to why you created it, great job! However, I’m with Allen as well, dumping all provided options in the DHCP Lease would be fantastic! Especially option 66.

      Reply
  2. Pingback: Read DHCP options received by the client » Ingmar Verheij - The dutch IT guy

  3. Pingback: (Microsoft) Vendor specific DHCP options explained and demystified » Ingmar Verheij - The dutch IT guy

  4. Pik

    Hi. Can you enable non-interactive mode, so I can send us it in the script, so the broadcast packet and the response is displayed without waiting for the “d” key to be pressed. Cheers

    Reply
  5. scotepi

    Love the idea of this tool. the one thing for me it missing is the ability to specify a MAC address for a known hosts only network. If you supported a command like ‘d aa:aa:aa:aa:aa:aa’ or whatever format would work best

    Reply
  6. JM

    Very nice tool! I would also like to see an unattended mode so the tool can be used in scripting. I have a situation where I want a computer to reboot itself into WinPE and start a disk imaging task sequence, but ONLY if there is a DHCP server available. Thanks!

    Reply
    1. Vladimir Panteleev Post author

      I’ve added the --query option in version 0.3, which you may find useful. However you should be aware that DHCP is based on the UDP protocol which does not attempt to guarantee delivery, so you’ll need to account for the possibility of dropped packets.

      Reply
  7. rich

    Nice tool. Oddly i get the dhcp offer in the tool but my clients do not get them. Only seeing dhcp discover packets from the clients. How does the tool get the offer but clients do not?

    Reply
  8. Alvin Moore

    This is an awesome and extremely useful tool. I wish there was a method to set the Vendor-Class-Identifier. This would this be extremely useful and the only tool that I have seen that would allow you to easily perform this.

    Reply
  9. Ossi Talonpoika

    Thanks for this great tool. Have been looking for this.
    Is there a way to get url’s decoded? Right now option 66 (Boot Server Host Name) gets encrypted and dhcptest shows just weird characters like ╠☺k

    Reply
    1. Vladimir Panteleev Post author

      As far as I know, that option should not be encrypted. It’s possible that dhcptest can’t interpret the reply packet correctly. Can you capture a sample using WireShark, and post the capture file here (or email it to me)?

      Reply
  10. Vladimir

    Hello Vladimir.

    Can you send me your email. I need help with dhcp options reading. May be you agree make some special software.

    Reply
  11. Peter

    Thanks for this great tool.

    Is there any chance of a 64bit binary? I am finding it very difficult to compile this, any suggestions?

    Keep up the excellent work!

    Reply
      1. Peter

        Yes, i intend to use this in a Windows PE environment. As i am using a 64bit Windows PE image i believe the subsystem to run 32bit applications is not present.

        I have attempted to compile with the -m64 switch however the linking seems to be failing for me and there are other dependencies for Microsoft studio which i am finding hard to configure in the build environment.

        Thanks

        Reply
  12. diego

    I suggest to make recursively send discovery packet. Sometime a dhcp server especially in small router all in one is not correctly disabled and randomly answer to a dhcp request. It’s a bug but it may help to find such malfunction. In other situation you may receive answer from a near dhcp cause it’s always faster in the network and 2 hour testing would be great for example.
    In any case thank you very much to share such a usefull tool.

    Reply
  13. Waldmar

    Vladimir, could you implement the feature to actually accept the DHCP Offer by replying and sending out DHCP Request? Currently the program simply sends out a discover, and display the offer, but does not actually lease out the IP.

    Thanks!

    Reply
    1. Philip

      This would help me as well. This seems to be the most complete/working DHCP tool around at the moment but is missing the Request portion.

      Reply
  14. Wez Nagwama

    Mate this saved my bacon today for diagnosing a complex PABX issue…thank you very much I really appreciate it.

    Protip: NEC phones expect a ‘byte array’ with each entry relating to a IP octet, with first entry being “1”.

    Reply
  15. Pingback: My vSphere Upgrade -or- How I Broke The Network | Frank's Tech Support

  16. Julien

    Hi very nice tool,

    Would be great if we ‘re able to send bootp packet to a specific server and not only to the 255.255.255.255 broadcast address.

    Reply
  17. Obiwan Kenobi

    Can you make it parse DHCP option 121 too? Right now it simply does a hex-dump.

    And an Android port would be fantastic. At the moment Android seems to be the major client platform having most DHCP-related issues (at least, in my world).

    Reply
    1. mike crowley

      While I don’t have a server with 121 setup, it seems simple enough to leave that processing to PowerShell.
      e.g.

      $Results = .\dhcptest-0.5-win64.exe –query
      $Results | where {$_ -like ‘*subnet mask*’} |

      Reply
  18. Johannes Grieb

    Hi thanks for the Tool, it is very helpfull.
    Sometimes I have Computers with multiple Network Interfaces (VLAN, Virtual Machines, and so on) is it possible to add functionality so one can Chose the Interface, or DHCP Test will use all Interfaces? Or is there something similar in there an i’m missing something?

    Reply
      1. Rick

        Thank you for this great tool.
        I have one issue with getting dhcp-option with –bind option. Issuing following command with –bind option never returns the dhcp-option.
        dhcptest –bind 192.168.1.100 –quiet –query –request 66 –print-only 66
        Without –bind option following command works and it successfully returns dhcp-option.
        dhcptest –quiet –query –request 66 –print-only 66

        I want to bind to a particular IP address. Using Wireshark, I see that DHCP OFFER packet from dhcp server has the request dhcp-option. Am I missing something here?

        Reply
  19. Rob Morin

    Can I use this to send many requests to a dhcp server to simulate a lot of traffic? I mean i have a dhcp server and i need to hammer it for testing.. i want to send 100s if not 1000’s of request to make sure the dhcp server can handle it.

    Thanks

    Reply
  20. Joseph LaRocca

    Downloaded latest windows version dhcptest-05. Program works when I run with “d” command but program core dumps when running with any options. The laptop is on Windows 7.

    Enter a command.
    d –query –request 43
    std.conv.ConvException@C:\Soft\dmd2d\windows\bin\..\..\src\phobos\std\conv.d(2211): Unexpected ‘-‘ when converting from type string base 16
    to type ubyte
    —————-
    0x000000013F89BF79
    0x000000013F8A1195
    0x000000013F8A122E
    0x000000013F8A12FA
    0x000000013F88457E
    0x000000013F88538B
    0x000000013F884EE8
    0x000000013F8B69B3
    0x000000013F8B689E
    0x000000013F8B6940
    0x000000013F8B689E
    0x000000013F8B67FC
    0x000000013F8ABF74
    0x000000013F8F959B
    0x0000000076FC59ED in BaseThreadInitThunk
    0x00000000770FB831 in RtlUserThreadStart
    Error on listening thread:

    Reply
  21. Joseph LaRocca

    The router on the client network is configured to block DHCP Discover msgs with Broadcast flag = Broadcast.

    The dhcptest tool sends a DHCP Discover with the Broadcast flag set = Broadcast.
    Bootp flags: 0x8000, Broadcast flag (Broadcast)
    1… …. …. …. = Broadcast flag: Broadcast
    .000 0000 0000 0000 = Reserved flags: 0x0000

    Can the dhcptest toll send a DHCP Discover with the Broadcast flag set = Unicast.
    Bootp flags: 0x0000 (Unicast)
    0… …. …. …. = Broadcast flag: Unicast
    .000 0000 0000 0000 = Reserved flags: 0x0000

    Reply
  22. Pawel

    Hi,

    Very nice tool. Would it be possible to add sending “INFORM” type instead of discovery? I would like to simulate a behaviour of Lync IP Phones and they send such requests:
    DHCP: INFORM (xid=0C77D73A)
    DHCP: Op Code (op) = 1
    DHCP: Hardware Type (htype) = 6
    DHCP: Hops (hops) = 0
    DHCP: Transaction ID (xid) = 209180474
    DHCP: Seconds (secs) = 0
    DHCP: Flags (flags) = 0000
    DHCP: Client IP Address (ciaddr) = 192.168.1.20
    DHCP: Your IP Address (yiaddr) = 0.0.0.0
    DHCP: Server IP Address (siaddr) = 0.0.0.0
    DHCP: Relay IP Address (giaddr) = 0.0.0.0
    DHCP: Client HW Address (chaddr) = xxxxxxxxxxxxx
    DHCP: Server Host Name (sname) =
    DHCP: Boot File Name (file) =
    DHCP: Magic Cookie = xx.xx.xx.xx
    DHCP: Option Field
    DHCP: DHCP MESSAGE TYPE( 53) = (Length: 1) DHCP INFORM
    DHCP: Server Identifier( 54) = (Length: 0) 0.0.0.0
    DHCP: Client Identifier( 61) = (Length: 7) ☺ (xxxxxxxxxxxxx)
    DHCP: SIP Server( 120) = (Length: 0) enc:0 ()
    DHCP: Host Name( 12) = (Length: 8) xxxxxxxxx
    DHCP: Vendor Identifier( 60) = (Length: 12) MS-UC-Client
    DHCP: Param Req List( 55) = (Length: 2) 120 43
    DHCP: Vendor Info( 43) = (Length: 0) ()
    DHCP: End of this option field

    Thanks,
    Pawel

    Reply
  23. Albert

    Could option 132 & 160 be added?
    They are both used with Polycom phones
    132 = string = VLAN ID
    160 = string = Provisioning URL

    Thanks in advance

    Reply
  24. Zach

    Great Tool! I used this to read the DHCP options being given (in hex) from an old IP Phone system to help me migrate to a new Windows DHCP server! Thank you sir!

    Reply
  25. Daniel

    Very useful tool! I second Pawel’s wish for an option to send INFORM, it would make it possible to get hostname (option 12).

    Reply
  26. Steven Van Hauwermeiren

    Hi, just tested your tool, amazing, but the information of option 66 seems to be strange characters. Any Idea?
    It should be an IP address
    Steven

    Reply
    1. Vladimir Panteleev Post author

      RFC 2132 describes option 66 as “TFTP server name” and seems to imply it’s a string, so dhcptest describes it as such by default. But if you want to parse it as a 4-byte binary IP address, you can use e.g. --print-only 66[IP].

      Reply
  27. Dimitry

    Hi Vladimir,

    Nice work!

    One question about the –secs switch: how do I use it? 🙂
    Or maybe it’s better to describe what I want to accomplish: I want to time how fast (or slow for that matter) a DHCP server is responding to a request. Is that possible by using the –secs switch? Or do you (or anyone else) have an other suggestion?

    We’ve a routed (MPLS) network with clients on one location and servers running in the datacenter. We want to move the DHCP servers (Microsoft DHCP) from the location to the datacenter and I want to see if and what performance impact this has for the DORA process, in other words in getting an IP address from DHCP by (wireless) clients at the location (before move and after move).

    When using the switch I see that the secs field in the sending packet increase with 256*N for every “–secs N” switch value. But in the receiving packet the secs field value is always 0 (at least at the test Win10 x64 device).

    Thanks in advance.

    Kind regards.

    Reply
  28. Dimitry

    Hi Vladimir,

    Nice work!

    One question about the –secs switch: how do I use it? 🙂
    Or maybe it’s better to describe what I want to accomplish: I want to time how fast (or slow for that matter) a DHCP server is responding to a request. Is that possible by using the –secs switch? Or do you (or anyone else) have an other suggestion?

    We’ve a routed (MPLS) network with clients on one location and servers running in the datacenter. We want to move the DHCP servers (Microsoft DHCP) from the location to the datacenter and I want to see if and what performance impact this has for the DORA process, in other words in getting an IP address from DHCP by (wireless) clients at the location (before move and after move).

    When using the switch I see that the secs field in the sending packet increase with 256*N for every “–secs N” switch value. But in the receiving packet the secs field value is always 0 (at least at the test Win10 x64 device).

    Thanks in advance.

    Kind regards.

    Dimitry

    Reply
    1. Vladimir Panteleev Post author

      --secs controls the value to place in the BOOTREQUEST packet header, which the RFC describes as “seconds elapsed since client began address acquisition or renewal process”.

      Why not time dhcptest’s execution time directly, e.g. using the time command?

      See also the --timeout option.

      Reply
  29. Colin

    Thank you so much for putting together such a versatile little tool Vladimir, AND for releasing the source AND for coding it in D. I’ve modified the code to suit our environment and added a few options we look for. I also had to change the options type for option 66 as it was handling it as a string (and spitting out ANSI chars) rather than an IP. But, all easy stuff thanks to you publishing your work. You’ve literally saved me hours – thanks again.

    Reply
  30. Ricardo

    Hi Vladimir,
    How are you? I am using you DHCP client (Excellent work) and I came to a problem on getting the Offer and the ACK steps to complete the DHCP Client & DHCP server connection.
    C:\Windows_test\dmd.2.080.1.windows\dmd2\windows\bin>dhcptest –query –option “60=radio_1” –option “51=429496” –option “61[hex]=00:11:3a:df:1c:ed”
    –wait
    dhcptest v0.7 – Created by Vladimir Panteleev
    https://github.com/CyberShadow/dhcptest
    Run with –help for a list of command-line options.

    Listening for DHCP replies on port 68.
    Sending packet:
    op=BOOTREQUEST chaddr=88:CF:6C:7B:D0:7B hops=0 xid=8A90FE01 secs=0 flags=8000
    ciaddr=0.0.0.0 yiaddr=0.0.0.0 siaddr=0.0.0.0 giaddr=0.0.0.0 sname= file=
    4 options:
    53 (DHCP Message Type): discover
    60 (Vendor class identifier): radio_1
    51 (IP Address Lease Time): 429496 (4 days, 23 hours, 18 minutes, and 16 secs)
    61 (Client-identifier): 00 11 3F DF 1C ED
    Received packet from 172.16.8.1:67:
    op=BOOTREPLY chaddr=88:CF:6C:7B:D0:7B hops=0 xid=8A90FE01 secs=0 flags=8000
    ciaddr=0.0.0.0 yiaddr=172.16.10.25 siaddr=0.0.0.0 giaddr=0.0.0.0 sname= file=
    6 options:
    53 (DHCP Message Type): offer
    54 (Server Identifier): 172.16.8.1
    51 (IP Address Lease Time): 315360000 (521 weeks and 3 days)
    1 (Subnet Mask): 255.255.248.0
    43 (Vendor Specific Information): 83 06 AC 10 08 01 05 1B
    60 (Vendor class identifier): radio_1
    My issue is that after the offer I never received the Request and the ACK ? any ideas why ? or how I can decode this problem ?
    Thank you for your help
    Ricardo

    Reply
    1. Vladimir Panteleev Post author

      I think the request is supposed to be sent by the DHCP client. As dhcptest is mainly a testing tool, it doesn’t implement that part of the transaction. I think it’s possible to make dhcptest to send a request packet instead of discover with --option 53=request, but at this point I think you probably want to use a real DHCP client?

      Reply

Leave a Reply

Your email address will not be published. Required fields are marked *