Umhlahlandlela ophelele wephrothokholi ye-DHCP: ukusebenza, izinzuzo, nokuphepha

Informatec Digital » Amanethiwekhi » Umhlahlandlela ophelele wephrothokholi ye-DHCP: ukusebenza, izinzuzo, nokuphepha

Ukusebenza kahle nangokuphephile kwanoma iyiphi inethiwekhi yesimanje kuncike kakhulu endleleni amakheli e-IP abiwa futhi aphathwa ngayo kumadivayisi axhunyiwe. Yilapho iphrothokholi ye-DHCP iba ​​khona njengomsindisi weqiniso wamabhizinisi, amakhaya, kanye nabaphathi bezinhlelo. Nakuba ukusebenza kwayo kungabonakali kubasebenzisi abaningi, ukuyiqonda kuvula umnyango wokwenza amanethiwekhi abe ngcono, ukuvimbela ukwehla kokuxhumana, kanye nokuvikela ezinsongweni ezivamile.

Kule migqa elandelayo, sihlukanisa konke okubalulekile mayelana ne- Dynamic Host Configuration Protocol (DHCP) ngolimi olucacile nolufinyelelekayo . Sihlanganisa konke kusukela encazelweni yayo, ukubaluleka kwayo, kanye nokusebenza kwayo okuningiliziwe, kuya ezinhlotsheni zesabelo sekheli le-IP, izinzuzo kanye nokungalungi, ukusetshenziswa, amathiphu okuphepha, kanye nezimo zangempela ekuphathweni. Uma ufuna umhlahlandlela ophelele noqondile wokuqonda i-DHCP ngokujulile, uzothola lonke ulwazi olubalulekile lapha.

Iyini iphrothokholi ye-DHCP futhi isetshenziselwa ini?

I-Dynamic Host Configuration Protocol (DHCP) ubuchwepheshe obujwayelekile obuvumela ukwabiwa okuzenzakalelayo nokuphakathi kwamakheli e-IP kanye namanye amapharamitha enethiwekhi kuwo wonke amadivayisi (amaklayenti) axhunywe kunethiwekhi. Ukusetshenziswa kwayo kuqeda isidingo sokuhlela lawa makheli ngesandla kudivayisi ngayinye, okungaba yinto engenakwenzeka ezindaweni eziphakathi noma ezinkulu.

Kungani kubaluleke kangaka? Ngoba ngaphezu kokwabela amakheli e-IP, le protocol iphinde inikeze ulwazi oluyisisekelo, njenge- subnet mask , i -default gateway , kanye namaseva e-DNS kumakhasimende, ngaleyo ndlela kuqinisekiswe ukuthi idivayisi ngayinye ingakwazi ukuxhumana kahle ngaphakathi nangaphandle kwenethiwekhi yayo yendawo.

I-DHCP yavela ku-BOOTP endala futhi isezingeni ku-RFC 2131 kanye ne-RFC 2132. Ukuba lula kwayo nokuvumelana nezimo kuyenza ibe yitshe legumbi lokuphathwa kwenethiwekhi, kusukela emahhovisi amancane kuya ezikhungweni zedatha ezinkulu kanye nengqalasizinda ye-IoT.

Isetshenziswa nini i-DHCP?

Ukusetshenziswa kwephrothokholi ye-DHCP kudlulela cishe kunoma iyiphi inethiwekhi enamadivayisi angaphezu kwambalwa. Amabhizinisi, izikhungo zemfundo, amahhovisi, amanethiwekhi asekhaya, izikhala zomphakathi, amahhotela, ngisho nama-cafe athembele kuyo ukuze avumele amadivayisi axhunyiwe ukuthi axhumane futhi aphequlule i-inthanethi kalula.

Kumanethiwekhi lapho amadivayisi ahlala engena futhi ephuma, njengasezindaweni ezinamanethiwekhi e-Wi-Fi kubasebenzi, amaklayenti, noma izivakashi, umsebenzi ozokwenziwa ngesandla we-IP uzoba nesiphithiphithi. Kubalulekile futhi ezindaweni lapho inethiwekhi ikhula ngokushesha noma lapho amakhompyutha, amaphrinta, amakhamera, omakhalekhukhwini, namadivayisi e-IoT kuhlangana khona.

Akusizi nje kuphela ezinkampanini ezinkulu; kubalulekile nasemakhaya lapho omakhalekhukhwini abaningi, amakhompyutha, ama-smart TV, kanye nezinye izinto ezisetshenziswayo zidinga ukuxhumeka. Inzuzo yayo eyinhloko ukonga isikhathi nokuvimbela amaphutha, ukuqinisekisa ukuthi kokubili i-laptop esanda kufakwa kanye nenzwa yokuzenzakalela yasekhaya zithola ikheli lazo le-IP elifanele kanye nemingcele ngokushesha nje lapho zixhuma.

Isebenza kanjani i-DHCP? Incazelo yesinyathelo ngesinyathelo

Inqubo yokwabela ikheli le-IP kusetshenziswa i-DHCP isekelwe ohlelweni lokushintshana kwemiyalezo phakathi kweklayenti neseva. Kungumjikelezo ohlelwe kahle kakhulu, owaziwa ngokuthi i-DORA (Ukubika Nokubikwa Kwamadokhumenti Okuhlobene).

• Discover: Iklayenti lethula isicelo sokusakaza lifuna iseva ye-DHCP kunethiwekhi.
• Ukunikeza: Iseva iphendula ngokunikezwa kwekheli le-IP nenye idatha yenethiwekhi.
• Isicelo: Iklayenti lamukela isipho ngokucela ngokusemthethweni ikheli elinikeziwe.
• Vuma (ACK): Iseva iqinisekisa umsebenzi ozokwenziwa futhi ikheli le-IP lihlala lisetshenziswa iklayenti isikhathi esithile (isikhathi sokuqashisa).

Le nqubo yonke ivame ukusebenzisa amachweba e-UDP angu-67 (iseva) kanye no-68 (iklayenti). Uma kunamaseva amaningi, iklayenti liyamukela isipho sokuqala esitholiwe. Ngaphezu kwalokho, i-DHCP ivumela ukuhlinzekwa kolwazi olwengeziwe njengezizinda ze-DNS, amaseva e-WINS, amaseva e-NTP, izinketho ze-PXE zokuqalisa kabusha okude, kanye nokucushwa okwenziwe ngokwezifiso.

Izingxenye eziyinhloko ze-DHCP

Ukuze uqonde ngokugcwele inqubo, kubalulekile ukwazi izakhi ezihilelekile:

• Iseva ye-DHCP: Iphatha i-IP pool nezinketho zokumisa. Lokhu kungaba idivayisi ezinikele (i-Windows Server, i-Linux, noma izinto zikagesi) noma irutha yakho yasekhaya.
• Iklayenti le-DHCP: Noma iyiphi idivayisi ecela i-IP: amakhompyutha, omakhalekhukhwini, amaphrinta, amakhamera, ama-thermostats, njll.
• Ukudluliselwa kwe-DHCP: Ivumela izicelo ukuthi zifinyelele iseva uma ikwenye i-subnet. Lokhu kubalulekile kumanethiwekhi amakhulu, ahlukene.
• Isizindalwazi semvume: Irekhodi langaphakathi lamakheli e-IP abelwe, ubani onalo, isikhathi esingakanani, kanye nobudlelwano bawo namakheli e-MAC.

Lesi sizindalwazi sibalulekile ukugwema ukuphindaphinda nokulawula ukusetshenziswa kahle kwebanga lamakheli atholakalayo.

Izinhlobo zekheli lomsebenzi ozokwenziwa ku-DHCP

Akuwona wonke amanethiwekhi adinga imodeli efanayo yokwabiwa. Iphrothokholi ye-DHCP ivumela izindlela ezintathu eziyinhloko zokusabalalisa amakheli e-IP:

• Ukwabiwa okunamandla: Icala elivame kakhulu. Amakheli e-IP asatshalaliswa okwesikhashana phakathi kwamakhompyutha, awavuselelayo noma awashintshe ngokusekelwe ekutholakaleni (alungele izindawo ezinamadivaysi amaningi ashintsha njalo).
• Isabelo esizenzakalelayo: Iseva ye-DHCP yabela ikheli lasesizindeni se-inthanethi, futhi ngisho noma idivayisi inqamuka, iligcina phakade noma ize ikhishwe mathupha. Lokhu kuwusizo kumadivayisi adinga ikheli le-IP elingashintshi kodwa angafuni ukulungisa yonke into mathupha.
• Umsebenzi owenziwa mathupha (ukubhuka noma i-DHCP emile): Ukuhlobana okuqondile kuchazwa phakathi kwekheli le-MAC nekheli le-IP elithile, okuqinisekisa ukuthi idivayisi ihlala ithola ikheli le-IP elifanayo. Lokhu kulungele amaseva, amaphrinta enethiwekhi, amaswishi, nanoma yiziphi izisetshenziswa ezibalulekile.

Bakhetha ifomula eyodwa noma enye kuye ngenethiwekhi kanye nezidingo zokulawula. Futhi qaphela, noma iyiphi indlela ivumela ukufakwa kwezinye izinketho ezifana ne-DNS, NTP, WINS, izizinda, namanye amaseva.

Izinzuzo kanye nokubi kwephrothokholi ye-DHCP

Ukuduma kwe-DHCP kungenxa yezinzuzo zayo ezinkulu, kodwa kubalulekile ukwazi ukulinganiselwa kwayo.

Izinzuzo ze-DHCP

• Qedela okuzenzakalelayo: Iqeda ubunzima bokucushwa okwenziwa ngesandla, inciphisa amaphutha, futhi isheshise ukuxhumeka kwemishini emisha.
• Ukusebenziseka Kwezinsizakusebenza: Thatha ithuba lechibi lekheli ukuze ulungise isidingo sangempela, uvimbele ama-IP ukuthi angasetshenziswa kancane.
• Scalability kanye nokuhamba: Abasebenzisi bangahamba phakathi kwamanethi angaphansi, amahhovisi, noma amazwe ngaphandle kokukhathazeka ngezinguquko zenethiwekhi.
• I-Centralization: Ikuvumela ukuthi uguqule imingcele yenethiwekhi yawo wonke amadivayisi usuka endaweni eyodwa, ngaphandle kokubuyekeza idivayisi ngayinye.
• Ukuvimbela ukungqubuzana: Ivimbela amadivayisi amabili ekubeni ne-IP efanayo, ngakho-ke, amaphutha okuxhumana.
• Ukuguquguquka: Isekela ukulungiselelwa kwangokwezifiso kobubanzi obuthile, amadivayisi abalulekile, noma izivakashi.

Ukungalungi kwe-DHCP

• Ukuncika Kweseva: Uma iseva ye-DHCP yehluleka, amadivayisi amasha awakwazi ukuthola i-IP futhi alahlekelwe ukuxhumeka kunethiwekhi.
• Ingozi yokuhlaselwa: Ngaphandle kokuvikelwa, ungaba ngaphansi kokuvinjelwa kwesevisi (DoS) noma ukukhwabanisa (i-DHCP spoofing).
• Amathuba amaphutha amakhulu: Uma inketho (i-DNS, isango, njll.) ingalungiselelwanga kahle, ukwehluleka kusabalala kuwo wonke amakhompyutha ngokushesha.
• Ukuphathwa kwezokuphepha: Idinga izinyathelo ezengeziwe zokuqinisekisa ukuthi amaseva asemthethweni kuphela asabalalisa ama-IP.

Kumanethiwekhi abalulekile, ukutholakala okuphezulu (ukuhluleka) nokuqapha okuqhubekayo kunconywa ukulindela noma yiziphi izinkinga nokunciphisa izingozi.

Imikhuba emihle kakhulu ekusebenziseni nasekulungiseleleni i-DHCP

Ukucushwa okufanele kwe-DHCP kungenza umehluko phakathi kwenethiwekhi esebenza kahle kanye nomthombo wezinkinga eziphindelelayo. Nawa amanye amathiphu abalulekile asekelwe kokuhlangenwe nakho kanye nemibhalo yobuchwepheshe:

• Chaza izigaba zamakheli ezicacile: Lungisa i-pool enani langempela lamadivayisi futhi ubeke amakheli e-IP wamadivayisi abalulekile. Gwema ukugqagqana kwe-subnet.
• Setha izikhathi zokuqashisa ezifaneleUma unemishini eshintsha njalo, sebenzisa izivumelwano zokuqashisa ezimfushane. Kumaseva angashintshi, khetha ukuqashisa isikhathi eside noma ukubhuka.
• Iqinisekisa ukutholakala okuphezulu: Noma nini lapho kunokwenzeka, setha amaseva e-DHCP angasasebenzi noma sebenzisa i-faillover ukuze unciphise umthelela wokucisha.
• Ibeka endaweni eyodwa futhi ukubhuka kwemibhalo: Amalogi lapho amakheli e-IP esetshenziswa ukhiye ngamunye otholwayo ukuze enze ukunakekelwa nokuxazulula izinkinga.
• Buyekeza futhi ugade iseva: Buyekeza amalogi, buyekeza isofthiwe, nezixwayiso zedizayini zamaphethini angavamile noma ukuncipha kwechibi.
• Yenza kusebenze izici ezithuthukile: Izinqubomgomo ze-DHCP, ukuhlanganiswa ne-DNS eguquguqukayo, ukuhlanganiswa ne-IPAM, noma usizo lokuphatha olubhalwe phansi ukuze kuthuthukiswe ngokuzenzakalela nokuhlola indawo ezungezile.

I-athikili ehlobene:

Umhlahlandlela ophelele we-Windows Server: Ukuthi Iyini, Isetshenziselwa Yini, Nezinguqulo Zayo

Ukuphepha Kwenethiwekhi nge-DHCP: Izingozi Nokuvikela

Ukuphepha kumele kube yinto eza kuqala kusukela ekuqaleni kwanoma yikuphi ukuthunyelwa kwe-DHCP. Ukusebenza ngaphandle kokuqinisekiswa kwemvelo kukushiya usengozini yokuhlaselwa njalo.

• Iseva ye-DHCP Eqinile: Umhlaseli ufaka iseva ye-DHCP mbumbulu kunethiwekhi eletha amakheli e-IP angalungile noma anonya, okungenzeka aqondise kabusha ithrafikhi kumawebhusayithi mbumbulu noma ukuyivimba (Indoda Ephakathi).
• Indlala ye-DHCP: Umhlaseli uthumela izinkulungwane zezicelo ngamakheli mbumbulu we-MAC kuze kube yilapho yonke i-IP pool isiphelile, okushiya abasebenzisi abasemthethweni ngaphandle kwegeyimu.
• Izinguquko zokucushwa kwenqwaba: Ngokuphathwa kabi, ukungalungiseki kahle kusabalala kuwo wonke amaklayenti.

Ungazivikela kanjani?

• I-DHCP Snooping: Isici samaswishi aphethwe esivumela kuphela ithrafikhi ye-DHCP esemthethweni ngezimbobo ezigunyaziwe.
• IP Source Guard: Ivimba ithrafikhi evela kuma-IP angagunyaziwe kusetshenziswa isizindalwazi se-DHCP Snooping njengesithenjwa.
• Ama-VLAN nokuhlukaniswa: Ikhawulela ububanzi beseva ye-DHCP ngayinye futhi yenza kube nzima ukuthi ukuhlasela kusabalale.
• Ukuqapha ilogu: Ukutholwa kusenesikhathi kwamaphethini angajwayelekile kusiza ukuvimbela ukuhlasela ngaphambi kokuthi kudale umonakalo omkhulu.
• Ukuqinisekiswa komsebenzisi nge-802.1X: Ezimweni ezinzima, qinisekisa ukuthi amadivayisi aziwayo kuphela afinyelela kunethiwekhi ngaphambi kokuthola i-IP yawo.

Ukuzivikela okungcono kakhulu ukuhlanganisa zonke lezi zinyathelo futhi uzibuyekeze ngezikhathi ezithile ukuze uvumelane nezinsongo ezintsha.

Izibonelo nokucushwa okusebenzayo kumaseva e-DHCP

Enye yamandla amakhulu e-DHCP ukuguquguquka kwayo: ungayisebenzisa ezinhlelweni ze-Windows Server, i-Linux, ama-router asekhaya, noma izinto zikagesi zobungcweti njenge-pfSense. Indawo ngayinye inikeza izinketho ezahlukene:

• IWindows Server: Ukuhlanganiswa ne-Active Directory, ukuphathwa nge-PowerShell kanye ne-graphical console, ukucwaninga okuthuthukisiwe kanye nokuhluleka kwendabuko.
• Linux: I-ISC-DHCP kanye namaseva e-Dnsmasq, ukwenza ngokwezifiso okuphezulu, ukuhlanganiswa kweskripthi, nokuphathwa kobubanzi ku-subnet ngayinye.
• pfSense nokunye okufanayo: Ukubhuka okuthuthukile, ukuhlanganiswa kwe-VLAN, uhlu lokulawula i-MAC, izinketho ezithile, nokulawula okuyimbudumbudu kwezindawo ezichwepheshile.
• Amarutha asekhaya: Izinketho eziyisisekelo zebanga le-IP, ukubhuka okulula kwe-MAC, nokusetha okusheshayo kusuka kuphaneli yewebhu.

Kuzo zonke izimo, i-listening port (67) kumele icatshangelwe, futhi kumele kuqinisekiswe ukuthi akukho firewall evimba ukuxhumana. Ngaphezu kwalokho, ezinhlelweni ze-Windows, uma iklayenti lingakwazi ukuthola iseva ye-DHCP, ekugcineni lizozinika ikheli le-IP ebangeni le-169.254.0.0 (APIPA), okubonisa inkinga yenethiwekhi noma yokucushwa okungenzeka.

Ezinye izindlela namaphrothokholi ahlobene ne-DHCP

Nakuba i-DHCP iyinketho evamile, kunezinye izindlela zezimo ezicacile kakhulu:

• IBHODI: Umanduleli we-DHCP. Isetshenziselwa ikakhulukazi izinqubo zokuqalisa ukude kumakhompyutha angenadiski.
• I-SLAAC (Ukumisa Okuzenzakalelayo Kwekheli Elingenasimo): Okujwayelekile kwe-IPv6, ivumela ukumisa okuzenzakalelayo okungenaseva, kusetshenziswa umzila njengomthombo wedatha. Iwusizo ku-IoT kodwa inolawulo oluncane kune-DHCPv6.
• I-Zeroconf: Isethi yamaphrothokholi yokumisa ngokuzenzakalela amanethiwekhi amancane endawo ngaphandle kokungenelela okwenziwa ngesandla.
• Umsebenzi owenziwa mathupha: Nikeza ama-IP ngayinye ngayinye. Kunconyelwe kuphela amanethiwekhi amancane kakhulu, azinzile.

Enye nenye inezihibe zayo: ukuguquguquka okuncane, ingozi yamaphutha enziwa ngesandla, noma ukuntuleka kokuhlanganiswa nezinsizakalo ezithuthukisiwe.

Amaphutha ajwayelekile kanye nendlela yokuwaxazulula

Enye yezinkinga ezivame kakhulu kubasebenzisi beWindows yiphutha le-DHCP Lookup. Ngokuvamile libonisa ukuthi ikhompyutha ayikwazi ukuthola ikheli le-IP elivumelekile ngezizathu eziningana:

• Iseva ye-DHCP iphansi noma ayifinyeleleki
• Irutha engalungiselelwanga kahle
• Ikhadi lenethiwekhi noma izinkinga zomshayeli
• Ukulungiselelwa kwe-subnetting okungalungile

Izixazululo ezisebenza kahle kakhulu zifaka phakathi ukuvuselela ikheli le-IP nge -`ipconfig /renew` , ukuqala kabusha i-router, ukubuyekeza abashayeli, ukusebenzisa i-Windows troubleshooter, noma, uma kudingeka, ukusetha kabusha konke ukucushwa kwenethiwekhi. Ezindaweni ezinkulu, ukushintsha isigaba se-subnet kungadingeka uma inani lamadivayisi lidlula ububanzi obuvunyelwe.

Ukugcina isofthiwe yakho isesikhathini nokusetha uhla lwamakheli olulungile ngokuvamile kungavimbela izinkinga ezivame kakhulu.

I-athikili ehlobene:

Imodeli ye-TCP/IP kanye Nezendlalelo Zayo: Umhlahlandlela Ophelele Ochazelwe Wonke Umuntu

Lokhu kubuyekezwa okujulile kokusebenza, izinhlobo, izinzuzo, ubungozi, nemikhuba engcono kakhulu yephrothokholi ye-DHCP kuveza indima yayo eyisisekelo ekuphathweni kwenethiwekhi. Ukusebenzisa kahle konga isikhathi futhi kunciphisa amaphutha, kuyilapho kusiza ukukala, ukuphepha, nokulawula. Kubalulekile ukwenza izinyathelo zokuphepha ezisebenzayo futhi uhlale uqaphile ukuze uvimbele izinkinga. Ngokulandela iseluleko esifanele, noma iyiphi inethiwekhi inganikeza uxhumano oluqinile, oluvikelekile olulungele ukukhula.