`tcpdump bootp.type == 2` tcpdump: syntax error

Question

tcpdump -i eth0 'bootp.type == 2'

Results in a:

tcpdump: syntax error

However, bootp.type == 2 works fine in Wireshark.

Also tcpdump -i eth0 'tcp[13] & 16!=0' works fine, no syntax error.

update: I am attempting to follow the answer here https://serverfault.com/a/8534/101677

Answer 1

Ahh, it isn't possible. bootp.type filter is only for Wireshark & TShark. I need to use TShark for the bootp.type filter. This works for me:

tshark -i eth0 -Y 'bootp.type == 2'

Here are the options explained from man tshark:

-i <capture interface>

-Y <displaY filter>

Source: https://serverfault.com/a/304715/101677

Update: The -Y <display filter> option is available on at least tshark 1.10.6, some servers may have an older version like 1.8.10 which don't support that filter. If you cannot or don't want to install a new version then use the -R <read (display) filter>.