what comes first ip address or authentication

[Uraken]

Hi all i am probably being really 'fick' here but can anyone tell me definitively what happens first when an ipod/iphone device connects to the network. Does it get issued an ip address from dhcp and then have to authenticate via any wireless security or is that it has to authenticate before it gets an ip.

 

I ask because my dhcp server is filling up with iphone/ipods and i can't imagine them guessing ir being told the wpa keys.

 

As always thanks in advance for any help.

 

Uraken

[tmcd35]

AFAIK any wireless device authenticates with the Access Point before the dhcp request is sent across the rest of the network.

[Uraken]

Thats how i would of thought it happened but this does not explain the dhcp leases also what protocol dooe sit use? if its tcp surely it must have an ip to do this?

[tmcd35]

The protocal would be TCP and no it does not need an IP to do this. What happens is the device broadcasts a dhcp request packet across the network and awaits for a reply to be broadcast back. AFAIK, all machine on the network would receive both network packets as they are broadcast to the network as a whole and not directed to any one machine. Only the dhcp server will respond to the first packet, all other PC's will simply discard the packet. Simarly on the PC requesting an IP address, assuming it's marked with the PC's MAC address, would open and use the responding packet - again all other computers will receive and ignore that packet.

 

You are right, it doesn't explain the leases.

 

Are all the leases live at the same time? Is it one, or a handful of devices, that have been given the AP key requesting an address multiple times. Maybe days or hours apart?

[powdarrmonkey]

The protocal would be TCP

 

Wrong. http://www.faqs.org/rfcs/rfc2131.html

[themightymrp]

We are having a similar problem with ipods filling up our IP addresses. However we know that some silly bugger has leaked our WEP key to the Sixth Form so am having to think about changing the SSID throughout the school.

 

I don't suppose anyone knows a way, using built in Windows features, that I can block these ipods receiving an IP once I have a list of their MAC addresses??

[powdarrmonkey]

I don't suppose anyone knows a way, using built in Windows features, that I can block these ipods receiving an IP once I have a list of their MAC addresses??

 

Give them a reservation with a stupid IP.

[themightymrp]

DOH! Why didn't I think of that before??!! Cheers

[oxide54]

there is also block/allow built into the newer versions of DHCP server. 2008 R2 yes. 2008 maybe. 2003 downloadable add-in.

 

but yes reservation with stupid ip would be preferable

[bio]

I don't suppose anyone knows a way, using built in Windows features, that I can block these ipods receiving an IP once I have a list of their MAC addresses??

 

If you have an Windows 2008 R2 DHCP server you can create a mac-address block list

 

bio..

[mac_shinobi]

Give them a reservation with a stupid IP.

 

Because they are all apple devices - just a thought here, am guessing they all use the same make of network card so the first part of the mac address should be the same, is there anyway to use a wild card or the likes when you use a dhcp reservation to dish out daft network details ??

[SYNACK]

Because they are all apple devices - just a thought here, am guessing they all use the same make of network card so the first part of the mac address should be the same, is there anyway to use a wild card or the likes when you use a dhcp reservation to dish out daft network details ??

 

Ban all Apple devices from the network, I like the way you think

[powdarrmonkey]

Because they are all apple devices - just a thought here, am guessing they all use the same make of network card so the first part of the mac address should be the same, is there anyway to use a wild card or the likes when you use a dhcp reservation to dish out daft network details ??

 

Nope, and it would be short-sighted to do so anyway.

[sted]

Nope, and it would be short-sighted to do so anyway.

 

and odds on they are say broadcom/realtek wifi cards anyway rather than really apple so you would probably wnd up blocking legit laptops etc

 

as mentioned simplest way is just to give them a stupid ip reservation

[themightymrp]

OK, the block feature of DHCP is built in to 2008 R2 only. However with this free add-in you can add the feature to 2003 or 2008 R1 server

 

DHCP Server Callout DLL for MAC Address based filtering - Microsoft Windows DHCP Team Blog - Site Home - TechNet Blogs

 

All you need to do is modify a TXT file to tell it to deny the following MAC addresses and then populate as many MAC's as you can find! Personally I just went down the list of DHCP leases and looked for obvious ones such as 'Dannys-ipod'. The MAC's are right there in the console. Working a treat so far Have managed to block 43 devices this morning!

[apeo]

and odds on they are say broadcom/realtek wifi cards anyway rather than really apple so you would probably wnd up blocking legit laptops etc

 

as mentioned simplest way is just to give them a stupid ip reservation

 

I believe that Apple devices (laptops, phones, mp3 players etc) use Apple mac addresses. As to how Apple uses its range of mac addresses i dont know, they may use a range for certain device groups..

Edited November 9, 2010 by apeo
typo

[GrumbleDook]

I prefer to look at DHCP reservations for all devices based on MAC addresses anyway to try and help audit needs. You can then limit the scope in DHCP too ... problem solved.

[Uraken]

Guys thanks for your help with this i have server 2008 and have never come across a block mac address feature in dhcp so i a off to do some reading, i really appreciate everyone's input into this thread.

 

regards

uraken

[mac_shinobi]

Nope, and it would be short-sighted to do so anyway.

 

cant argue with that - was a long long shot lol

[mac_shinobi]

How do you get the down arrow pointing down to the bottom left and also what is that button and what does that link to and do ?

[mac_shinobi]

and odds on they are say broadcom/realtek wifi cards anyway rather than really apple so you would probably wnd up blocking legit laptops etc

 

as mentioned simplest way is just to give them a stupid ip reservation

 

I hadn't had my first cuppa when I posted that and was a long shot but in hind sight that is correct or at least I would think so as there are other realtek / broadcom devices out there.

[powdarrmonkey]

Personally I just went down the list of DHCP leases and looked for obvious ones such as 'Dannys-ipod'. The MAC's are right there in the console. Working a treat so far Have managed to block 43 devices this morning!

 

You're still tackling the wrong problem. I'd be much less relaxed about them being connected in the first place if it was me...

 

(why are you still using WEP?)

[powdarrmonkey]

How do you get the down arrow pointing down to the bottom left and also what is that button and what does that link to and do ?

 

Click it if you're curious, and please don't derail the thread any further.