-: Let's talk about DHCP logs and configuration files,
and how they're helpful to you inside of an instant
response as you are doing threat management.
Well, first lets talk about what is DHCP?
DHCP is Dynamic Host Configuration Protocol,
but I think you already knew that.
It provides an IP address, a default gateway,
subnet mask and DNS server to a host.
If you're sitting for the CSA+ exam,
you should have known this already from your Network+,
your A+, or your Security+ certifications.
DHCP server logs and configurations are useful though
for us during passive reconnaissance, which is why
we are talking about them right now.
You can combine these with your firewall logs
and your other network logs that we've talked about already
and determine which hosts are using dynamic and static IPs.
Which is really useful, because if a bad guy gets
into a particular user's machine, and that user's machine
uses DHCP that changes every three days, that IP address
is going to change every three days.
It's going to look like there's malware spreading
across the network when really it's still only
the one machine possibly.
So you need to be able to look at this and figure
this type of thing out.
Now let's look at configuration file for DHCP.
This one comes from a standard DHCP server configuration.
You'll notice the default lease time which says 600.
That's going to tell us how long it's going
to keep that lease before it asks for a new one.
The max lease time of 3600, how long it's going to keep it.
The subnet mask, the broadcast address, the router,
and then the domain name servers.
Then the subnet mask that is handing out that range.
In this case it's handing out IP addresses from 192.168.1.50
through 1.250.
So there's 200 IP addresses that it will hand out
over the course of its day.
Now the host can come from any of those.
In this case the host name is courses.jasondion.com
which just happens to be one of my websites
and the fixed address that it has.
So that web server would have 192.168.0.10,
where everything else is going to be handed out dynamically.
That's the idea here inside the DHCP configuration
on this particular file.
Now, lets look at some logs for that.
Here's an example of some file server logs.
You'll see that the name fileserver went through DHCP
and got an address.
It got a 60 second lease and it's under the 25% threshold
and so it's going to remain unaltered and it's going
to give it the lease and renew it again.
The next thing, it's going to do a request.
It says, "Hey, I'm asking for a DHCP request.
This is my request. Here is my MAC address."
it's going to acknowledge that request
and then it's going to acknowledge that request
with assigning that IP address to it.
This is what the DHCP logs give you right?
It's giving you an IP address associated with a MAC address.
Because most of the time, it's not supposed to change
on a machine right?
But there are ways that an attacker can change
you MAC address but we're going
to leave that out for right now.
IP addresses change all the time.
MAC addresses are supposed to be hardware configured
to that particular workstation.
So it's the only way to truly identify that workstation
is by that MAC address.