Example: Network of company A has 5 VLANs: Accounting, IT, Guests, Servers, Board.

All VLANs has DHCP servers enabled in their own VLANs. I am monitoring a single VLAN for DHCP packets by connecting my own PC into one of those networks. Using Fingerbank API (to fingerprint devices using DHCP packets) I can happily fingerprint those devices using above API to get knowledge what kind of device it is.

But I wish to have a single computer be able to see ALL broadcast packets from ALL VLANs. I know I can use SPAN for receiving mirror of network traffic, but I am not sure whether it is possible to see ARP/DHCP packets aswell. Any solution to this case or I have to use 1 VM for 1 VLAN separately?

I cannot imagine doing this within a company having 30 or more VLANs just to monitor DHCP packets.

For reference I use Cisco switches.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 14, 2019 at 18:18

1 Answer 1


By far the easiest solution is a single DHCP server (cluster) for all VLANs. Use switches or routers (helpers) to relay DHCP requests to the server and monitor all requests there.

Using a hypervisor, you could also use a single machine attached to every VLAN using a dedicated vNIC for each. Depending on the hypervisor you could alternatively set up a port group monitoring all VLANs.

Edit: All mirroring/monitoring port solutions without filtering can potentially overwhelm the monitoring port. In best case, the capturing machine just misses DHCP request. In worst case, other important traffic is lost (e.g. on a virtual host with a shared downlink).

  • So using SPAN port won't help me, because it won't ever see the broadcast traffic? Means broadcast packets wont reach my sniffing device?
    – RedS
    Jan 4, 2019 at 21:35
  • 1
    SPAN should work as well. However, all mirroring/monitoring approaches without filtering have a potential bandwidth problem.
    – Zac67
    Jan 4, 2019 at 21:45
  • But will I be able to see DHCP/ARP packets aswell via SPAN? I have never used it
    – RedS
    Jan 4, 2019 at 22:19
  • 1
    SPAN mirrors all traffic from the monitored port(s) to the mirror port, including DHCP and ARP.
    – Zac67
    Jan 5, 2019 at 8:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.