Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rapid DHCP: Or, how do Macs get on the network so fast?

cafbit.com

Post reply on HN
Print view View original

31–40 of 191 posts

Re: Rapid DHCP: Or, how do Macs get on the network so fast?

#31

Post by cbs »

kenjackson wrote: post #8

This implementation by the Mac feels wrong. I mean it appears to work, but it seems like a violation of the protocol and can result in problems on the network. Maybe security issues (?). I'm not an expert in any of these things, but I'd love to hear a network protocol/security experts take on this.

This certainly smells fishy, the client is relying on ARP to assume its OK to reclaim that IP address before it actually gets the authoritative answer from the DHCP server. IP networking does not require that computers submit to dhcp, so depending on how you look at it, it probably doesn't run afoul of the spec.

I'd have to get a more detailed packet capture and reference some RFCs, but given DHCP isn't manditory, I don't think it would be harmful to the mac or network as long as the client's DHCP lease was still valid when it pulled this stunt, otherwise you could get multiple clients claiming the same IP address.

From a security standpoint rather than only revealing just your most recently DHCP-assigned address, you're revealing both the mac address of the nearest layer 2 device and gateway ip of (some nonzero number of) networks you've recently connected to. If a hostile network were to monitor the arp requests to successfully emulate a network the connecting mac had recently been connected to, the IP traffic prior to DHCP ACK that was abridged in the article would probably be sent again. Not knowing what it contained, I can't speculate as to if it would be any different than the network communication that would be done if connecting to a new network.

(Even if everything else was application traffic, I don't anything about the udp/192 protocol for airports, but it may be spoken with assumptions made about the connected network and a vector worth exploring).

Re: Rapid DHCP: Or, how do Macs get on the network so fast?

#32

Post by cbs »

aaronblohowiak wrote: post #22
kenjackson wrote: post #8

This implementation by the Mac feels wrong. I mean it appears to work, but it seems like a violation of the protocol and can result in problems on the network. Maybe security issues (?). I'm not an expert in any of these things, but I'd love to hear a network protocol/security experts take on this.

Not security. You usually rely upon security for network layers 1-4 as being actual security. Adding additional controls can be useful in slowing down would-be attackers, or "casual" intruders, but they are not "real" security measures.

The lower level networking protocols do rely on some levels of peer trust, but carefully controlling that trust has come a long way in the last decade. If I'm correct in assuming by "actual security" you mean "physical security" you're making some pretty broad and faulty statements (even about layer 1).

There are many networking devices and techniques for hardening hostile networks at layer 2. Layer 3 is IP; to say level 3 (or 4) measures are not "real" is throwing HUGE swaths of security out the window.

Re: Rapid DHCP: Or, how do Macs get on the network so fast?

#33

Post by Locke1689 »

saurik wrote: post #20
kelnos wrote: post #18

Earlier quoted context omitted.

Why would that be the case? Assuming it only does this if it knows its previous DHCP lease hasn't run out, it's very likely (unless the DHCP server has been rebooted or has otherwise lost its lease table) that no other device is using that IP. And even if it screws this up, it looks like it does a proper DHCP request about a second after the interface comes up, so the problem will be fixed quickly. Do you have any ev…

By the time the problem is "fixed" the other computer on the network has already detected that its IP address is in conflict by ARP, telling the user what happened (interrupting them) and has shifted to a new IP address (losing all of its active connections in the process). (and yes: some routers hold on to only a certain number of inactive leases, and routers actually do get rebooted in home, office, and hotel envir…

Once again, this is almost always a router misconfiguration problem. If you don't want this to happen configure your router correctly. Apple isn't to blame for other people's incompetence.

Plus, this seems to produce tangibly better results in the majority of cases. It perfectly fits Apple's style of optimizing for the common use case, even if the rarer gets worse.

Re: Rapid DHCP: Or, how do Macs get on the network so fast?

#34

Post by kcbanner »

pinko wrote: post #9

This is a great example of Apple's detail-oriented focus on real-world user experience, and helps explain why people prefer Macs even if they can't always explain why. Lots of little things just work better. You (where "you" == myself and many others, even if not /you/ personally) are left overall with an experience of less frustration.

Is this case the Mac user may get a better UX, but the user who's IP was just stolen has a worse one.

Re: Rapid DHCP: Or, how do Macs get on the network so fast?

#35

Post by kcbanner »

masklinn wrote: post #5
jrsmith1279 wrote: post #3

I've always wondered why my Mac jumps right on the network, while other devices such as my Xbox 360 take a few seconds before the connection is there. I'd be interested to see how the Google Chrome CR-48 handles DHCP since it seems like it takes a bit of time before getting online and allowing me to log in to it.

ChromeOS is based on linux, so I'd expect something similar to what Android does: userland dhclient with the same performance profile as the tablet he tested.

I think I'd still prefer the standards compliant client, even if it was a slightly slower. Kicking other users off the network isn't a good thing.

Re: Rapid DHCP: Or, how do Macs get on the network so fast?

#36

Post by cbs »

troels wrote: post #14

Anecdotally, my mac is absolutely horrible at connecting to my wifi. I often have to try multiple times and some times I give up, have to walk over to the router and restart it before I can get on. Probably an issue with the router ultimately, but I don't have this problem with other devices.

Anecdotally, my mac is absolutely horrible at connecting to my wifi.

There are certain networks they loathe to connect to and I haven't been able to find a common cause. The 802.1x authentication at college took lots of fiddling around on my mac every time I tried to connect, while all my other devices worked fine.

Re: Rapid DHCP: Or, how do Macs get on the network so fast?

#37

Post by simmons »

thecombjelly wrote: post #30

Interesting. I have Arch Linux running on a Asus Eee pc and I was always happy that it was connected and ready to go as soon as I woke it up from sleep (including WiFi). I can access the internet within a second of waking it up. I'm using NetworkManager and I wonder if it isn't doing something similar? But then everyone else on Linux is claiming it takes much longer.

Huh, interesting. My Asus EeePC 1000 has the slowest network sign-on of any of my devices, but I'm running Ubuntu 10.04 on it. I wonder of Arch Linux has better Wi-Fi drivers or something. I the author of the original blog post, and I performed a similar protocol analysis on my EeePC. Surprisingly, the DHCP handshaking was actually pretty fast, it just seems to take a long time to establish the link. I should really upgrade the OS one of these days.

Re: Rapid DHCP: Or, how do Macs get on the network so fast?

#38

Post by simmons »

masklinn wrote: post #5
jrsmith1279 wrote: post #3

I've always wondered why my Mac jumps right on the network, while other devices such as my Xbox 360 take a few seconds before the connection is there. I'd be interested to see how the Google Chrome CR-48 handles DHCP since it seems like it takes a bit of time before getting online and allowing me to log in to it.

ChromeOS is based on linux, so I'd expect something similar to what Android does: userland dhclient with the same performance profile as the tablet he tested.

I'm the author of the original blog post. I also ran my tests with a Samsung Series 5 Chromebook. Its DHCP Vendor-Class string is "dhcpcd 5.1.4". The DHCP performance seems fair, around 2 seconds. However, the total network initialization time tends to be a bit longer. It may have some of the same link establishment delays that I'm seeing on my Ubuntu 10.04 EeePC.

Re: Rapid DHCP: Or, how do Macs get on the network so fast?

#39

Post by thecombjelly »

simmons wrote: post #37
thecombjelly wrote: post #30

Interesting. I have Arch Linux running on a Asus Eee pc and I was always happy that it was connected and ready to go as soon as I woke it up from sleep (including WiFi). I can access the internet within a second of waking it up. I'm using NetworkManager and I wonder if it isn't doing something similar? But then everyone else on Linux is claiming it takes much longer.

Huh, interesting. My Asus EeePC 1000 has the slowest network sign-on of any of my devices, but I'm running Ubuntu 10.04 on it. I wonder of Arch Linux has better Wi-Fi drivers or something. I the author of the original blog post, and I performed a similar protocol analysis on my EeePC. Surprisingly, the DHCP handshaking was actually pretty fast, it just seems to take a long time to establish the link. I should really…

I have a EeePC 900A and the driver for wireless is by far the best I've experienced on Linux.

Re: Rapid DHCP: Or, how do Macs get on the network so fast?

#40

Post by windsurfer »

jsz0 wrote: post #28
saurik wrote: post #15

> This network recognition technique allows the Mac to very rapidly discover if it is connected to a known network. If the network is recognized (and presumably if the Mac knows that the DHCP lease is still active), it immediately and presumptuously configures its IP interface with the address it knows is good for this network. Ok, seriously? That isn't a bug in an implementation somewhere, but in fact a feature that…

If your DHCP server is handing out leased addresses to other clients you might have bigger problems to worry about. For example if you expect a lot of churn on the network you should be using much shorter leases times.

How is this the DHCP server's fault? DHCP is designed to reassign unused leases to new clients if the subnet is all leased out.
Post reply on HN