DHCP and ARP

Lesson plan

Level

Beginner

Time

About 65 minutes; the steps below add up to 63

Learners work out what a laptop must be given to join a friend’s Wi-Fi and how it could find a printer’s hardware address, so DHCP and ARP answer problems they have already named. Predictions then precede the broadcast Discover, why four messages are needed, what ARP asks, the ARP cache, reaching a remote server and a dishonest answer. The habit to build: ask what a device knows at each moment, and what it still needs.

Objectives

• Explain what DHCP gives a joining device and why it is a lease
• Follow the four DORA messages and explain why each is needed
• Follow ARP for a local destination and for a remote one through the gateway
• Explain ARP spoofing and the controls that limit it

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the Ethernet switching, Subnetting and Ports and Sockets lessons first.
• Write the four DORA initials down the side of the board, to fill in as each message is explained.
• The lesson takes about 63 minutes. To teach it in two parts, stop after “ARP example A: send to a local printer”; the second part opens with “ARP example B: send towards a remote web server”.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Explain what DHCP gives a joining device and why it is a lease
   • Follow the four DORA messages and explain why each is needed
   • Follow ARP for a local destination and for a remote one through the gateway
   • Explain ARP spoofing and the controls that limit it

   Purpose: Learners work out what a laptop must be given to join a friend’s Wi-Fi and how it could find a printer’s hardware address, so DHCP and ARP answer problems they have already named. Predictions then precede the broadcast Discover, why four messages are needed, what ARP asks, the ARP cache, reaching a remote server and a dishonest answer. The habit to build: ask what a device knows at each moment, and what it still needs.

2. 1. Joining a network Think 5 min

   Purpose: Name the two things a joining device needs before either protocol appears.

   Ask

   • What was the laptop given, and by whom?
   • How could it find the printer’s hardware address?

   Responses to expect

   • “An address” comes quickly; prompt for the way out and name lookups.
   • On screen in turns: the opening question, its answer; then the question on finding the printer’s hardware address, and its answer.

   Discussion pause: Collect suggestions for the second question before revealing.

   In the lesson window

   • Think it through: You take your laptop to a friend’s house and join their Wi-Fi. Within seconds it can reach websites, yet you typed in no settings. What must the laptop have been given, and by whom?
   • Think it through: Your laptop knows the IP address of a printer on the same network, but local delivery needs the printer’s hardware address too. How could the laptop find that out?

3. 2. Configuration first, local delivery next Explain 6 min

   Purpose: Introduce DHCP, the lease and ARP with the hotel comparison, and separate them from DNS.

   Ask

   • Which protocol finds a neighbour?

   Responses to expect

   • DNS is the usual wrong answer.
   • On screen in turns: the opening; then DHCP as the reception desk; ARP as finding a neighbour; how DHCP, ARP and DNS differ; the check question on which protocol finds the printer, and its answer; where the hotel comparison stops.

   Misconceptions to challenge

   • A learner may believe: “ARP and DNS do the same job.” Respond: DNS turns names into IP addresses; ARP turns an IP address into a MAC address.

   In the lesson window

   • Check your understanding: A laptop needs the hardware address of the printer beside it. Which of the three protocols named in this step does that job: DHCP, ARP or DNS?

4. 3. A worked DHCP DORA exchange Predict 14 min

   Purpose: Follow DORA, why it needs four messages, and the settings it delivers.

   Ask

   • How can a device with no address send its first request?
   • Why not two messages?
   • What can it reach without a gateway?

   Responses to expect

   • Several learners think the Offer already confirms the lease.
   • Diagram: reveal the DORA messages one at a time; before each, ask who sends it, to whom, and why it is broadcast or not.
   • On screen in turns: the opening; then the settings the DHCP server can offer; the question on sending the first request with no address, and its answer; the DORA exchange, starting with Discover; Offer; Request; Acknowledge; the question on why two messages would not be enough, and its answer; why the exchange needs four stages, and the result; the check question on a missing gateway, and its answer; DHCP’s ports, and its layer; broadcast or unicast, relays and renewals.

   Misconceptions to challenge

   • A learner may believe: “DHCP is Layer 2 because it uses broadcast.” Respond: It is an application-layer protocol; delivery does not decide layer.

   To go further

   • Why must the Request be broadcast rather than sent only to the chosen server?

   In the lesson window

   • Think it through: The laptop has no IP address yet and does not know where a DHCP server is. How can it send its first request?
   • Think it through: Why not just two messages, a request and a reply? Look at the Offer and the Request: what could go wrong with only two?
   • Check your understanding: Suppose the Acknowledge gave the laptop an address and a mask but no default gateway. What could it still reach?

5. 4. ARP example A: send to a local printer Predict 8 min

   Purpose: Follow an ARP request and reply for a local printer, and the cache.

   Ask

   • What will the laptop ask, and who hears it?
   • Should it ask before every packet?

   Responses to expect

   • Most predict the broadcast correctly.
   • On screen in turns: the opening; then the laptop and the printer; the question on what the laptop must ask, and its answer; the ARP exchange, starting with the laptop’s decision; the ARP request; the printer’s reply; caching, and sending the frame; the question on asking before every packet, and its answer; the ARP cache, and what ARP does not do.

   Discussion pause: Reveal the ARP steps one at a time; ask what the laptop does next before each appears.

   In the lesson window

   • Think it through: The laptop wants to send to the printer at 192.168.1.20 for the first time. What will it need to ask, and who will hear the question?
   • Think it through: The laptop sends hundreds of packets to the printer. Should it ask “who has 192.168.1.20?” before every one?

6. 5. ARP example B: send towards a remote web server Predict 8 min

   Purpose: Show that a remote destination means resolving the next hop.

   Ask

   • How can a frame head towards another network?
   • What is the destination IP inside the frame?

   Responses to expect

   • The common error is asking for the server’s MAC address.
   • On screen in turns: the opening question, its answer; then resolving the next hop for a remote server; why ARP never crosses the internet; the check question on the packet inside the frame, and its answer; the same rule with two networks.

   Misconceptions to challenge

   • A learner may believe: “The device asks for the remote server’s MAC address.” Respond: It asks for the gateway’s; the server’s IP address stays in the packet.

   If the explanation does not land: Use the letter-and-post-office picture: the envelope goes to the post box, but the address on it is still the final one.

   In the lesson window

   • Think it through: An ARP request is heard only on the local network. So how can the laptop send a frame towards a server on another network?
   • Check your understanding: In that outgoing frame, the destination hardware address is the gateway’s. What is the destination IP address of the packet inside it?

7. 6. ARP spoofing and defensive controls Predict 6 min

   Purpose: Explain ARP spoofing and the three controls, and their limits.

   Ask

   • What could a dishonest device do?

   Responses to expect

   • “Answer for the gateway” usually comes with one hint.
   • On screen in turns: the opening question, its answer; then ARP spoofing; three controls that help, starting with checking ARP against DHCP; segmentation; encryption, and what none of them does.

   If the explanation does not land: Someone in a crowded room shouts “Who is Sam?” and a stranger answers “Me!”; with no check, the message goes to the stranger.

   In the lesson window

   • Think it through: Any device can answer “who has 192.168.1.1?”, and the laptop believes the answer. What could a dishonest device on the network do with that?

8. 7. IPv4 and IPv6 are different Explain 3 min

   Purpose: Note that IPv6 uses Neighbour Discovery, not ARP.

   Ask

   • Can DORA and ARP be carried over to IPv6 unchanged?

   Responses to expect

   • No: ARP is for IPv4 only; IPv6 has Neighbour Discovery.
   • On screen in turns: the opening; then reading a device’s ARP cache.

9. 8. Apply it in a new situation Apply 5 min

   Purpose: Set up independent application, ideally on a later day.

   Ask

   • Who will try these now, and who later in the week?

   Responses to expect

   • The café address tests DHCP failure; the cache tests spoofing signs; HTTPS tests what encryption does and does not do.
   • On screen in turns: the opening question, its answer; then the question on two IP addresses sharing one MAC, and its answer; the question on HTTPS on a spoofed network, and its answer.

   In the lesson window

   • Apply it: At a café, your laptop shows a 169.254 address and cannot reach anything. Which of the two protocols in this lesson most likely failed?
   • Apply it: A laptop’s ARP cache shows the gateway, 192.168.1.1, and another device, 192.168.1.30, with the same MAC address. What should you think?
   • Apply it: An attacker on a café network has spoofed the gateway, but the user is on an HTTPS site. What does HTTPS protect?

10. 9. Check your understanding Check 5 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The relay question links to the Go deeper note in the DORA step.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

11. 10. What to remember Consolidate 3 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: the four DORA messages, in order.

    Responses to expect

    • Discover, Offer, Request and Acknowledge, in that order.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

12. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • DHCP: your own settings, on a lease.
    • Four messages, and only the last one confirms.
    • ARP: who has this IP address?
    • Remote traffic: resolve the next hop, keep the real destination.
    • ARP believes any answer, so it can be spoofed.

Consolidation

• DHCP: your own settings, on a lease.
• Four messages, and only the last one confirms.
• ARP: who has this IP address?
• Remote traffic: resolve the next hop, keep the real destination.
• ARP believes any answer, so it can be spoofed.