Packet analysis lab 5 of 12
DHCP and DNS: troubleshoot a new office from the packets
A new office PC gets no address, and once it does, it can't resolve a single name. You capture the DHCP discovers that nobody answers, fix the missing relay, read DORA and its options through the relay, find the scope handing out a dead DNS server, fix it, and then read DNS records, CNAMEs, MX answers and NXDOMAIN replies.
Run this lab
It needs Lite: its 4 nodes are set to 4 vCPU and 3,072 MB in total. That fits the free demo too.
In your workspace: Shared, then Packet analysis with Wireshark and tcpdump guided labs, then 05 - DHCP and DNS - troubleshoot a new office from the packets
- Level
- Intermediate
- Time
- About 70 minutes
- Nodes need
- 4 vCPU, 3,072 MB
- Smallest plan
- Lite
The scenario
Fellside Outdoor has opened a back office on a new subnet behind router R1. Its first PC, PC1, is set to get its address by DHCP from the company's server SRV in the server room. The office manager reports two things: PC1 gets no address at all, and "when it did work for a moment yesterday, no websites opened". Your workstation WS is a tap between PC1 and R1, with its own address on br0 for testing.
| Device | Interface | Address | Role |
|---|---|---|---|
| PC1 | eth0 | DHCP (pool 10.60.10.100–199) | new office PC |
| WS | br0 (eth0 + eth1) | 10.60.10.50/24, gateway .1 | your tap and test client |
| R1 | Gi0/0 / Gi0/1 | 10.60.10.1/24 / 10.60.20.1/24 | office router |
| SRV | eth0 | 10.60.20.10/24 | DHCP server (scope in /etc/lab/dhcp.conf, for relayed clients) and DNS server for fellside.lab |
Your workstation, WS. Open WS's console (a remote desktop, root / eve), start Wireshark from Applications > Internet > Wireshark, and capture on eth1, the router side of the tap: it carries PC1's traffic and WS's own. Write answers in /root/answers.txt (pluma /root/answers.txt &). SRV is the same kind of desktop; open its console when you need its terminal.
What you’ll practise
- Identify the four DHCP phases and what each Request is for
- Read DHCP options: message type, server identifier, lease time, router, DNS servers and domain
- Explain DHCP relay and read the relay agent address
- Use DNS queries and responses to find failures and read A, AAAA, CNAME and MX records, TTLs and response codes
- Fix a missing relay and a wrong DHCP option, and prove the fix from a capture
The tasks
- Name the PC
- Capture the failing DHCP
- Fix the relay and read DORA
- Find out why names don't resolve
- Read DNS records
The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.
Topology and devices
The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.
Every link, as text
- PC1
eth0to WSeth0 - WS
eth1to R1Gi0/0 - R1
Gi0/1to SRVeth0
| Node | Device | Image in Add Node | Set to |
|---|---|---|---|
| PC1 | Alpine Linux | clbalpinebase-alpine-base-3-20-3 | 1 vCPU, 512 MB |
| WS | EVE-NG GUI server (Docker) | eve-gui-server:latest | 1 vCPU, 1,024 MB |
| R1 | Cisco IOSv | vios-adventerprisek9-m.SPA.159-3.M6 | 1 vCPU, 512 MB |
| SRV | EVE-NG GUI server (Docker) | eve-gui-server:latest | 1 vCPU, 1,024 MB |
How to open this lab
Sign in to your workspace at
lab.cloudlabbox.com.In File Manager, open Shared, then the folder
Packet analysis with Wireshark and tcpdump guided labs.Open
05 - DHCP and DNS - troubleshoot a new office from the packetsand start its nodes, then open Lab Tasks for the scenario and the steps.
The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.
More Packet analysis labs
Related labs in other courses
CloudLabBox is independent of the Wireshark Foundation, CompTIA and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.