<div dir="ltr"><div><div>Hi ,<br><br></div> Final understanding - DHCP broadcast messages are not accepted by the switch till the port is authenticated. Only after the port is authenticated, broadcast message will be accepted , for which DHCP reply message holding the IP address for the client will come. Please correct the understanding if its wrong.<br><br></div><div>Thanks everyone for the clarification.<br></div><div><br><br></div>Thanks,<br>Sarah.<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Feb 3, 2015 at 6:02 PM, Jouni Malinen <span dir="ltr"><<a href="mailto:j@w1.fi" target="_blank">j@w1.fi</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Tue, Feb 03, 2015 at 02:57:37PM +0530, Sarah Thomas wrote:<br>
> Where DHCP is blocked before 802.1x.<br>
><br>
> But then the only question , what is socket for receiving dhcp braodcast<br>
> message for?<br>
><br>
> Thats after authentication is done?<br>
<br>
</span>No, that is ten year old implementation(*) of an alternative way for<br>
detecting if a device is connected to the wired port in a case where<br>
there is no proper support for the authorized/unauthorized port concept<br>
in a wired switch. I would not expect such device to be used in a real<br>
end user product, i.e., the Ethernet ports on a switch should really be<br>
able to indicate events on when the link goes up or down and those could<br>
be used to trigger EAPOL operations.<br>
<br>
I guess this DHCP-trigger is fine for testing and experimentation<br>
purposes and even something like a port behind which there are multiple<br>
devices which then get blocked somehow based on MAC address (e.g.,<br>
dynamic ebtables rules), but none of that should really be considered<br>
secure.<br>
<br>
(*)<br>
<a href="http://w1.fi/cgit/hostap-history/commit/?id=7bca4e8dfd76d92724f46149db7b1b1b2098c928" target="_blank">http://w1.fi/cgit/hostap-history/commit/?id=7bca4e8dfd76d92724f46149db7b1b1b2098c928</a><br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
Jouni Malinen PGP id EFC895FA<br>
</font></span><div class="HOEnZb"><div class="h5">_______________________________________________<br>
HostAP mailing list<br>
<a href="mailto:HostAP@lists.shmoo.com">HostAP@lists.shmoo.com</a><br>
<a href="http://lists.shmoo.com/mailman/listinfo/hostap" target="_blank">http://lists.shmoo.com/mailman/listinfo/hostap</a><br>
</div></div></blockquote></div><br></div>