How to Make a DHCP Listener using Scapy in Python

Dynamic Host Configuration Protocol (DHCP) is a network management protocol used to assign IP addresses and other network configurations to devices dynamically. To monitor DHCP messages, one can use a DHCP listener. In this guide, we’ll be using Python and a powerful packet manipulation library called Scapy to build our listener.

What you will need:

• Python installed.
• Scapy library.
• Basic understanding of networking concepts.

Step-by-step Guide:

1. Introduction to Scapy:

Scapy is a Python library that lets you craft, send, and analyze network packets. Its versatility allows you to handle tasks ranging from scanning to network discovery.

To install Scapy, simply use pip:

2. Understanding DHCP:

Before diving into the code, let’s first understand the DHCP process. When a device wants to join a network, it follows these main steps:

1. DHCP Discover: The device broadcasts a packet looking for a DHCP server.
2. DHCP Offer: A DHCP server responds with an offer packet containing an IP address for the device.
3. DHCP Request: The device requests the offered IP address.
4. DHCP Acknowledge: The server acknowledges and the device can use the IP.

Each of these steps involves sending or receiving a packet, which is what our listener will be looking out for.

3. Crafting the DHCP Listener:

Here’s a simple Python script that uses Scapy to listen for DHCP packets:

Here’s a breakdown:

• sniff(): Scapy function that captures packets.
• filter: We’re only interested in UDP packets on ports 67 and 68 (standard DHCP ports).
• prn: The function to call for each captured packet.

Inside the dhcp_monitor function, we inspect the DHCP portion of the packet to determine its type (Discover, Offer, Request, Acknowledge).

4. Running the DHCP Listener:

To run the listener:

1. Save the script.
2. Run the script with administrative privileges (because it requires raw socket access). On Linux, you might use sudo.

5. Interpreting Results:

The listener will output messages for each step of the DHCP process it captures. If a device joins your network, you should see a sequence of messages indicating the DHCP discovery process.

Why Create a DHCP Listener?

Creating a DHCP listener serves a few purposes:

1. Network Understanding: By listening to DHCP traffic, you can learn about the devices on your network, their IP addresses, and their activity.
2. Troubleshooting: If a device isn’t getting an IP address or facing connectivity issues, a DHCP listener can help you identify the problem.
3. Security: Monitoring DHCP traffic can help detect suspicious activity or unauthorized devices on your network.

Now, let’s get started with the step-by-step process of creating a DHCP listener using Scapy in Python.

Step 1: Install Scapy

To begin, you need to have Scapy installed on your system. Open your terminal and run the following command to install Scapy using pip:

Step 2: Import Scapy

Once Scapy is installed, you can start creating your DHCP listener script. To do this, open your favorite Python editor or IDE and create a new Python script. You’ll need to import Scapy at the beginning of your script, like this:

This line tells Python to import all functions and classes from Scapy.

Step 3: Create the DHCP Listener

Now, let’s create the DHCP listener. A DHCP listener listens for DHCP traffic and processes the DHCP packets that are sent within your network. Here’s the code for a simple DHCP listener:

Let’s break down this code:

• def dhcp_listener(packet):: This line defines a function named dhcp_listener, which takes a packet as an argument. A packet is a unit of data in network communication.
• if packet.haslayer(DHCP):: This line checks if the packet has a DHCP layer. In other words, it looks for DHCP packets within the network traffic.
• print(f"DHCP Request from {packet[IP].src}: {packet[DHCP].options[0][1]}"): If a DHCP packet is found, this line prints information about the DHCP request. It displays the source IP address (packet[IP].src) and the requested IP address (packet[DHCP].options[0][1]).

Step 4: Start the Listener

Now that you’ve defined your DHCP listener function, it’s time to start listening to the network. Add the following code to your script:

Here’s what this line does:

• sniff(): This function from Scapy allows you to capture network packets.
• filter="udp and (port 67 or port 68)": The filter parameter ensures that only UDP packets on port 67 (server) or port 68 (client) are captured. DHCP traffic primarily uses these ports.
• prn=dhcp_listener: This parameter specifies the function (dhcp_listener) to be called for each captured packet.
• store=0: This parameter ensures that captured packets are not stored in memory, saving system resources.

Step 5: Run the Script

Save your script and run it using your Python interpreter. As the script runs, it will capture DHCP requests and print information about them. You’ll see output similar to this:

These lines show the source IP address of the device making the DHCP request and the requested IP address.

Step 6: Analyzing the Output

By running your DHCP listener, you can gain valuable insights into your network. Here’s what you can understand from the output:

• Device Activity: You can see which devices are actively requesting DHCP leases.
• IP Address Assignments: You’ll know which IP addresses are assigned to devices.
• Potential Issues: If a device repeatedly requests an IP address or faces issues, it may indicate network problems.
• Unauthorized Devices: If you see unfamiliar devices in the output, it could be a security concern.

Advanced DHCP Listening

The example we’ve provided is a basic DHCP listener, but you can expand on it to suit your needs. Here are some advanced features you can add:

1. Logging: Instead of printing to the console, log the DHCP requests to a file for future reference and analysis.
2. Real-time Alerts: Set up alerts to notify you when certain conditions are met, such as an unknown device connecting to your network.
3. Historical Data: Store and analyze DHCP data over time to identify patterns and trends in your network usage.
4. Integration: Combine your DHCP listener with other tools and scripts to create a comprehensive network monitoring solution.

Security Considerations

While monitoring your network using a DHCP listener can be useful, it’s essential to be mindful of security and privacy. Here are some key considerations:

1. Legal and Ethical Implications: Ensure that you have the legal right to monitor your network, and respect the privacy of users.
2. Data Encryption: If your network uses encryption (e.g., WPA2/WPA3 for Wi-Fi), your DHCP listener may not capture packets in plaintext. Ensure you have the necessary encryption keys if you want to analyze encrypted traffic.
3. Access Control: Secure your DHCP listener script and the data it collects. Only authorized personnel should have access to this information.
4. Consent: If you’re monitoring a network used by others, it’s a good practice to inform users about the monitoring, especially if it’s a public or shared network.

Conclusion:

A DHCP listener can provide insights into the network’s activity, helping network admins troubleshoot issues or monitor unauthorized access. With Python and Scapy, building such tools is streamlined and effective.

Learn more