IP services: DHCP, DNS, NTP, syslog, SNMP and a little QoS

Discover, offer, request, acknowledge — the client broadcasts, a server offers an address, the client broadcasts its acceptance, and the server confirms with a lease.

• The discover comes from source 0.0.0.0 to 255.255.255.255, since the client has no address yet.
• The request is broadcast rather than unicast so other servers learn their offers were declined.
• The acknowledge carries mask, gateway, DNS servers, domain name and lease time.

Renewal starts at half the lease and is a unicast request and acknowledge, so a client keeps working through a brief server outage.

Because a discover is a broadcast and routers do not forward broadcasts; the helper address goes on the interface facing the clients.

• The router converts the broadcast into a unicast addressed to the server.
• It inserts the receiving interface's address so the server knows which pool to use.
• Putting the helper on the server-facing interface does nothing, because that interface never receives the broadcast.

ip helper-address also relays several other UDP broadcast services by default, which can be trimmed with ip forward-protocol if that is unwanted.

The switch port's VLAN, the gateway's helper address, reachability from router to server, and whether the pool is exhausted.

• A wrong VLAN means the broadcast never reaches a router that would relay it.
• A missing helper means it reaches the router and stops there.
• An exhausted pool means the server hears the discover and has nothing to offer.

Checking the server's lease list is decisive: if the discover appears there, the problem is on the return path or in the pool; if it does not, the problem is between client and server.

Because an RSA key pair for SSH is labelled with hostname.domain, so key generation fails without both.

• ip domain-name sets it, and it need not be a real internet domain.
• Name servers are separately required if the device is to resolve names for NTP or syslog targets.
• no ip domain-lookup disables resolution entirely, which stops typos hanging the session.

Changing the hostname or domain after generating a key invalidates it, so SSH stops working until a new key is generated.

Because log correlation, certificate validation and authentication protocols all depend on it.

• Reconstructing an incident across four devices is impossible if their clocks disagree.
• A device with a wrong clock rejects valid certificates and may accept expired ones.
• Kerberos rejects requests with more than five minutes of skew, which breaks domain logins outright.

Timestamps also need service timestamps log datetime, since IOS otherwise stamps messages with uptime, which is uncorrelatable no matter how accurate the clock is.

The number of hops from a reference clock: stratum 0 is the reference itself, a device synchronised directly to one is stratum 1, and each further hop adds one.

• Lower stratum is more authoritative.
• Stratum 16 means unsynchronised, and such a source is not used.
• ntp master 3 makes a device claim stratum 3, typically as an internal source.

The usual design has one or two devices synchronised externally and everything else synchronised to them, so the network stays internally consistent even when the internet link is down.

Zero to seven, with zero the most serious: emergency, alert, critical, error, warning, notification, informational, debugging.

• Configuring a level includes that level and everything more serious.
• Level 5 notifications include interface state changes, which is usually the right level for a syslog server.
• Level 7 is debug output and should never be a default destination on a production device.

Filtering a central log collector for severity 3 and below is a quick way to surface everything that actually failed across an entire estate.

Because the volume of messages can consume the CPU and make the device unresponsive, including to your own session.

• Debug output is generated at process level and is expensive per packet.
• Console logging is especially slow, so no logging console with terminal monitor is safer.
• undebug all stops everything and is worth typing before starting.

Conditional debugging, which restricts output to one interface or one address, makes the risk manageable when a debug genuinely is the only way to see what is happening.

Polling is the manager asking the agent for values on a schedule; a trap is the agent notifying the manager that something happened.

• Polling produces the regular counters behind utilisation graphs.
• Traps are unacknowledged, so one lost in transit is simply lost.
• An inform is a trap with an acknowledgement, so it can be retried.

Because polling is periodic, an event between polls is invisible to it, which is why most systems use both — traps for events and polling for trends.

Because the community string is a password sent in clear text in every packet, and there is no encryption of the data either.

• Anyone who captures one poll has the string.
• A read-write community allows an attacker to reconfigure the device.
• The historical defaults, public and private, are the first thing any scanner tries.

Where v2c is unavoidable, restricting it to read-only, binding it to an access list of specific manager addresses, and confining it to a management network reduces but does not remove the exposure.

Because it is sensitive to delay, jitter and loss rather than to bandwidth, and a congested queue produces all three.

• A call needs roughly 80 kbps but breaks above 150 ms of one-way delay or 1 percent loss.
• A file transfer will use every byte available and does not slow down politely.
• Without prioritisation, voice packets sit behind whatever arrived first.

Loss matters more for voice than for data because there is no retransmission — a lost packet is simply a gap in the audio, whereas TCP recovers a lost segment invisibly.

The point beyond which DSCP markings are believed; it exists because any host can set its own markings and would otherwise be able to jump every queue.

• Markings from managed devices such as IP phones are trusted.
• Markings from user PCs are rewritten to zero at the access port.
• Classification is done once at the edge so downstream devices act on the marking without re-inspecting traffic.

Setting the boundary at the phone rather than the switch port is deliberate, because the PC plugged into the phone must not inherit the phone's trusted status.

Shaping buffers traffic above the rate and sends it later; policing drops or re-marks it immediately.

• Shaping adds latency, policing adds loss.
• Shaping is applied outbound, typically to match a provider's contracted rate.
• Policing is applied inbound, to enforce a limit on someone else's traffic.

Shaping is gentler on TCP, which interprets delay as mild congestion and slows down, whereas policing causes retransmissions and a sharper collapse in throughput.

Expedited forwarding, DSCP value 46, the marking reserved for voice.

• It maps to a low-latency queue that is served before all others.
• The queue is bandwidth-capped so it cannot starve everything else.
• The AF classes carry other prioritised traffic in tiers, and 0 is best effort.

Markings are only honoured within networks you control: internet providers routinely reset DSCP at their edge, so end-to-end QoS across the public internet does not exist.

Because the pool covers the whole subnet by default, including the addresses already assigned statically to routers, switches, printers and servers.

• ip dhcp excluded-address reserves a range before the pool is defined.
• Without it the server will eventually hand out the gateway's own address to a client.
• The resulting duplicate-address conflict affects everyone on the subnet, not just that client.

The usual convention is to exclude the first twenty or so addresses of every subnet and keep all infrastructure inside that range, so the rule is the same everywhere.