2

tcpdump -i eth0 'bootp.type == 2'

Results in a:

tcpdump: syntax error

However, bootp.type == 2 works fine in Wireshark.

Also tcpdump -i eth0 'tcp[13] & 16!=0' works fine, no syntax error.

update: I am attempting to follow the answer here https://serverfault.com/a/8534/101677

2

Ahh, it isn't possible. bootp.type filter is only for Wireshark & TShark. I need to use TShark for the bootp.type filter. This works for me:

tshark -i eth0 -Y 'bootp.type == 2'

Here are the options explained from man tshark:

-i <capture interface>

-Y <displaY filter>

Source: https://serverfault.com/a/304715/101677

Update: The -Y <display filter> option is available on at least tshark 1.10.6, some servers may have an older version like 1.8.10 which don't support that filter. If you cannot or don't want to install a new version then use the -R <read (display) filter>.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.