<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'><font face="Verdana,sans-serif" size="3" style="font-size:12pt;" color="#000000">First of all, thank you so much for your replies and I have learned a lot from your responses.</font><div><font face="Verdana,sans-serif" size="3" style="font-size:12pt;" color="#000000"><br></font></div><div><font face="Verdana,sans-serif" color="#000000"><font size="3">I am working on a security research project in an isolated internal network, so fortunately there will not be any frustrated or angry clients :-). Basically the research is trying to find a way to randomly change clients' IP addresses so that any IP-based attack or reconnaissance might be </font>thwarted<font size="3">, that is why I am looking into the DHCP server to see if I can use it to achieve the goal. Any suggestions are very appreciated.</font></font></div><div><font face="Verdana,sans-serif" color="#000000"><font size="3"><br></font></font></div><div><font face="Verdana,sans-serif" color="#000000"><font size="3">Regards,<br id="FontBreak"></font></font><br><br><font face="Verdana"><div class="ecxgmail_default" style="font-family:verdana, sans-serif;font-size:small;display:inline;"></div>=======================<br>Jeffrey Zheng<br>The words of the reckless pierce like swords, but the tongue of the wise brings healing. (Proverbs 12:18)<br><br></font><div style="font-family:arial, sans-serif;font-size:13px;"><font color="#d24726">==></font><span style="color:rgb(34, 34, 34);"> <a href="http://www.learningpenguin.net/myblog/2014/05/09/password-tips-protecting-computer-and-data-part-one/" target="_blank">How to create a strong and secure password - part one</a></span></div><div style="font-family:arial, sans-serif;font-size:13px;"><font color="#d24726">==></font><font color="#222222"> </font><a href="http://www.learningpenguin.net/myblog/2014/05/13/password-tips-protecting-computer-and-data-part-two/" style="color:rgb(34, 34, 34);" target="_blank">How to create a strong and secure password - part two</a></div><br><br><div>> Date: Wed, 15 Oct 2014 12:23:14 +1100<br>> Subject: Re: Force DHCP server to assign new IP to client<br>> From: glenn.satchell@uniq.com.au<br>> To: dhcp-users@lists.isc.org<br>> <br>> Hi Jeffrey<br>> <br>> Perhaps you could give us some more information as to why you want this<br>> type of behaviour? Perhaps there may be a different way to achieve what<br>> you want?<br>> <br>> regards,<br>> -glenn<br>> <br>> On Wed, October 15, 2014 1:24 am, Simon Hobson wrote:<br>> > Jeffrey Zheng <jeffreyzheng@live.com> wrote:<br>> ><br>> >> I am working on a project in which I would like to force DHCP server to<br>> >> assign a new IP address to client whenever the client sends an IP<br>> >> request, instead of keeping the current IP address. Is it possible? If<br>> >> yes, can someone please tell me how to do it?<br>> ><br>> > As Chuck so eloquently put it, it's a recipe for "unhappy" clients. At the<br>> > very least it will terminate all active connections every time the client<br>> > renews it's lease, and with some clients it may cause bigger problems as<br>> > there have been reports on this list from time to time of clients not<br>> > handling changed leases very well.<br>> ><br>> > As pointed out, it's against the letter and spirit of the RFCs, which the<br>> > ISC coders worked hard to follow. Thus the ISC code goes to great lengths<br>> > to *NOT* change the client's address.<br>> > Apart from techniques like periodically changing the config to make some<br>> > addresses unavailable, one I can think of might go like :<br>> ><br>> > Write a script that monitors the logs, and every time an address is ACKed<br>> > make note of it.<br>> > The script then needs to update the DHCP config, explicitly making the<br>> > address unavailable - perhaps by adding it to a class and denying that<br>> > class access ot the address pool.<br>> > The next time the client attempts to renew, it's request will be Nacked<br>> > and it'll start over with a Discover to get a new address.<br>> > The script needs to clean up, removing the blocked IPs from the list. A<br>> > simple timeout would suffice but you could lose a lot fo addresses, but<br>> > you could monitor the logs for the DHCP-NAck and set the address to be<br>> > removed a short time later.<br>> ><br>> > It's a lot of work to go to just to break things and make life difficult<br>> > for your clients.<br>> ><br>> > _______________________________________________<br>> > dhcp-users mailing list<br>> > dhcp-users@lists.isc.org<br>> > https://lists.isc.org/mailman/listinfo/dhcp-users<br>> ><br>> <br>> <br>> _______________________________________________<br>> dhcp-users mailing list<br>> dhcp-users@lists.isc.org<br>> https://lists.isc.org/mailman/listinfo/dhcp-users<br></div></div> </div></body>
</html>