1

I'd like to capture DHCP packets with wireshark. When I use the filter: "udp.port == 67 or udp.port == 68" I only see the Discover and Request broadcasts.

While I thought the DHCP offer also gets broadcasted. I'm running wireshark on another machine then the machine which requests the ip but am connected to the same network.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 8:18
3

If you refer the DHCP RFC 3456,You can see that the DHCP offer message is actually unicast and not multicast.I would suggest you to monitor the ethernet interface of the client using wireshark itself or tcpdump in this case.

Otherwise a better approach would be to enable port mirroring on the interface which is connected to your client or simply connect it to hub(Old school,But it works!). enter image description here

Always refer the RFC.That is pretty much your bible!

I have also just did a trace on my laptop for your understanding as well.

1

Only Discover and Request packets are broadcast, Offer and Acknowledge are unicast. Unicasts are forwarded only to the switch ports they are required on, so you can't simply capture them across the network.

You need to capture the unicasts on either the DHCP server or the client, or set up a monitor port on your switch (or use a repeater hub instead of the switch).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.