Ask Your Question

Malformed bootp packet

asked 2024-04-13 12:45:06 +0000

thebadass gravatar image

updated 2024-04-13 14:23:42 +0000


I'm quite new to networking and a uni student, i'm trying to implement a dhcp server in Golang according to the RFC. I started the server and tried to test it with dhcping

The reply from my DHCP server implementation as captured by wireshark in this pastebin, i can't seem to figure out why wireshark reports it as a malformed packet

Added some debug logs from my server

Link to packet capture

edit retag flag offensive close merge delete


Can you share a capture file of the packet on a public file share then update the question with a link to it.

Chuckc gravatar imageChuckc ( 2024-04-13 13:01:32 +0000 )edit

@chucku i just did that, thanks!

thebadass gravatar imagethebadass ( 2024-04-13 13:18:04 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2024-04-13 16:37:13 +0000

johnthacker gravatar image

The client hardware address field ('chaddr') in DHCP is a fixed 16 octets. The hlen field indicates the length of the hardware address, and thus the number of those octets used. However, the remaining octets _must_ be present as padding. Your server is not including the 10 padding octets necessary and is only transmitting a 6 octet _chaddr_ field; put another way, the DHCP magic cookie is being transmitted inside the _file_ field as everything is shifted by 10 octets, and this leads to the packet being seen as malformed. As the first four bytes of the options field are not the DHCP Magic Cookie, it is instead interpreted as BOOTP.

edit flag offensive delete link more


Solved my issue and the packet is correctly interpreted now, thanks a bunch!

thebadass gravatar imagethebadass ( 2024-04-13 17:50:45 +0000 )edit

How does the client get the response if sent to 67 not 68?

No. Time    Source  UDP Srcport Destination UDP Dstport Protocol    Length  Info
78  5.882497   68   67  DHCP    282 DHCP Request  - Transaction ID 0x3b771a66
79  5.882816   67   67  BOOTP   328 Boot Reply[Malformed Packet]

Chuckc gravatar imageChuckc ( 2024-04-14 20:19:06 +0000 )edit

I later caught on that, and got it fixed.

thebadass gravatar imagethebadass ( 2024-04-21 16:49:47 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools


Asked: 2024-04-13 12:45:06 +0000

Seen: 65 times

Last updated: Apr 13