DHCP Plugin

This plugin dissects DHCP traffic and saves it in dump files as well export the information via NetFlow/IPFIX using the following information elements.

[NFv9 57825][IPFIX 35632.353][Len 6] %DHCP_CLIENT_MAC                   MAC of the DHCP client
[NFv9 57826][IPFIX 35632.354][Len 4] %DHCP_CLIENT_IP                    DHCP assigned client IPv4 address
[NFv9 57827][IPFIX 35632.355][Len 64 varlen] %DHCP_CLIENT_NAME          DHCP client name
[NFv9 57895][IPFIX 35632.423][Len 32 varlen] %DHCP_REMOTE_ID            DHCP agent remote Id
[NFv9 57896][IPFIX 35632.424][Len 48 varlen] %DHCP_SUBSCRIBER_ID        DHCP subscribed Id
[NFv9 57901][IPFIX 35632.429][Len 1] %DHCP_MESSAGE_TYPE                 DHCP message type

DHCP plugin support option --dhcp-dump-dir <dump dir>. When this option is used, nProbe writes DHCP dump files in <dump dir>. Multiple files are created in a hierarchical YYYY/MM/DD directory tree and each file is at most 1000-lines long.

An example of a created file is:

 When[uint]    MessageType[ascii:16]   DHCP_Server[ascii:32]   ClientMAC[ascii:32]     ClientIP[ascii:32]      ClientName[ascii:32]    TransactionId   LeaseTime[uint] SubscriberId[ascii:32]  AgentRemoteId[ascii:48]
1593701239      Offer(2)     00:25:90:D4:CC:F9           0xF8494A18      86400
1593701239      ACK(5)     00:25:90:D4:CC:F9           0xF8494A18      86400
1593701250      ACK(5)     00:25:90:D4:CC:F9           0x4EEC7C3B      86400
1593701256      ACK(5)     00:25:90:D4:CC:F9           0xBA0E6A54      86400

An extra command can be executed every time nProbe ends dumping a directory using option --dhcp-exec-cmd <cmd>. Command <cmd> is executed using system call system().


As this plugin dissects traffic packets, it is only available when nProbe is used in probe mode.