DHCP – Detect Full Pool from Monitored Traffic

dhcpprotocol-theoryrfc

Is there any way to detect full DHCP pool just from DHCP traffic??
I assume for simplicity just one DHCP server in network.
I have found in RFC 2131, that DHCP NAK is sent only in this case:

Server to client indicating client's notion of network
address is incorrect (e.g., client has moved to new
subnet) or client's lease as expired.

So I suppose DHCP NAK is not sent, when DHCP pool is full. But definitely it goes with full DHCP pool.
I have also found in this topic

Best practice using Cisco's "ip-helper" for DHCP?

If a DHCP server's scope is full, it won't reply with a DHCPOffer…

So I think when DHCP pool is full, clients will retransmit many DHCP DISCOVER, because of retransmitting algorithm defined in RFC 2131. I don't see better way to detect full DHCP pool from DHCP traffic. If anyone have better idea to detect it just from sent packets I would be really glad. Thanks in advance.

Best Answer

You are correct, just by looking at a bit of DHCP traffic, it is impossible to determine if a server is out of addresses. You cannot distinguish an empty pool from a crashed server, since in both cases the server will not respond to a DHCPREQUEST.

Theoretically, if you have access to all of the server's DHCP traffic from the very start, and have some info about its configuration, you could keep track of all the leases it hands out and completely emulate its bookkeeping. This would allow you to know when the server has allocated all available addresses.

Note that you would need some knowledge about the DHCP pool. A DHCP range is often a subset of a subnet, so you would need to know which addresses are available. Also, when the admin sets up stuff like addresses to be handed out to specific MAC addresses, things become even more complicated.

I'm afraid the best place to determine if a server is out of addresses still is... the server itself.

Related Solutions

Cisco – Specific DHCP pool on specific interface – IOS

If you configure an IP address on an interface the router will use the corresponding DHCP pool to answer DHCP requests. In your case you would do something like this:

interface Fa0/0
 ip address 192.168.0.1 255.255.255.248
!
interface Fa0/1
 ip address 172.16.0.1 255.255.255.248
!
ip dhcp pool 0
 network 192.168.0.0 255.255.255.248
 ...
!
ip dhcp pool 1
 network 172.16.0.0 255.255.255.248
 ...
!

The interface IP on Fa0/0 is inside the network for DHCP pool 0 and the IP on Fa0/1 is inside pool 1. So hosts on Fa0/0 will get addresses from pool 0 and hosts on Fa0/1 will get addresses from pool 1.

Cisco DHCP – Behavior of IP DHCP Pool and IP Helper-Address

Is the DHCP addresses given from the helper? or from the local pool?

You would get two possible DHCPOffer's from the device's internal DHCP pool and the DHCP server defined by the helper-address, but it's up to the client to decide which DHCPOffer to accept and to then unicast a DHCPRequest to the DHCP server of choice.

Often clients choose the DHCP server with the fastest DHCPOffer. Unless your device's CPU is bogged down, I would expect typical clients to select the DHCP pool more often than not. You'd expect a little less latency in a L2 operation vs L3 which is required to get to the DHCP server via the helper-address.

Best Answer

Related Solutions

Cisco – Specific DHCP pool on specific interface – IOS

Cisco DHCP – Behavior of IP DHCP Pool and IP Helper-Address

Related Topic