1

I am looking for the answer why packet captures in Wireshark doesn't contain DHCP offer message. I was trying to capture packets directly on the computer with installed Wireshark and doing a SPAN monitor port.

In both situations I am not able to see DHCP offer as on the following screen:

wireshark capture

I am using Wireshark 2.6.4 on MacOS Mojave.

Below is the simple diagram with a topology: net-diagram

Here is the switch configuration:

interface Vlan47
 ip address x.x.x.1 255.255.255.0
!
interface Vlan49
 ip address x.x.x.1 255.255.255.0
 ip helper-address x.x.x.55
!
SPAN monitor destination interface
 switchport access vlan 21
 switchport mode access
 switchport nonegotiate
 switchport block unicast
 no logging event link-status
 access-session port-control auto
 mab
 dot1x pae authenticator
 dot1x timeout tx-period 3
 storm-control broadcast level 2.00
 storm-control multicast level 5.00
 storm-control action trap
 spanning-tree portfast
 service-policy type control subscriber policy_name
 ip dhcp snooping limit rate 100
!
SPAN monitor source port
 switchport access vlan 49
 switchport mode access
 switchport nonegotiate
 switchport block unicast
 switchport port-security maximum 2
 switchport port-security maximum 1 vlan access
 switchport port-security violation restrict
 switchport port-security aging time 2
 switchport port-security aging type inactivity
 switchport port-security
 no logging event link-status
 mab
 dot1x pae authenticator
 dot1x timeout tx-period 3
 access-session port-control force-authorized
 storm-control broadcast level 2.00
 storm-control multicast level 5.00
 storm-control action trap
 spanning-tree portfast
 service-policy type control subscriber policy_name
 ip verify source
 ip dhcp snooping limit rate 100
!
DHCP server port
interface Port-channel1
 switchport trunk allowed vlan 47,70
 switchport mode trunk
 switchport nonegotiate
 switchport block unicast
 ip arp inspection trust
 ip arp inspection limit rate 100
 logging event link-status
 storm-control broadcast level 5.00
 storm-control multicast level 10.00
 storm-control action trap
 ip dhcp snooping limit rate 1000
 ip dhcp snooping trust
!
!
sh monit sess all
Session 1
---------
Type                     : Local Session
Source Ports             :
    Both                 : SPAN source port
Destination Ports        : SPAN dst port
    Encapsulation        : Native
          Ingress        : Disabled
!
!
  • We need to see your switch configuration, and a simple diagram would be helpful too. Without this information we're just guessing, which is off-topic here. – Ron Trunk Mar 28 at 12:37
  • I am using Cisco switch and I have connected one computer to the port (SPAN source) configured in VLAN 49 which is our SCCM deployment port and other port in VLAN 21 which is configured as a destination for SPAN monitor. In other situation I have directly connected computer with Wireshark to the switch port and I am capturing DHCP process. Its more about the Wireshark settings than my switch configuration. DHCP process is working well as I am getting IP. Please, correct me if I am wrong but is not possible to successfully achieve IP address without DHCP offer, right? – deuter Mar 28 at 12:55
  • That is not enough information. The obvious answer is something is not configured they way you think it is, but we can't tell what that might be. You can edit your question to include the configuration (use the preformatted text option { }). – Ron Trunk Mar 28 at 13:00
  • I've uploaded diagram and switch configuration. – deuter Mar 29 at 11:41
4

This is a bug/limitation of the recent versions of the capture driver of WireShark

On MacOs Mojave 10.14.3 or 10.14.4, with WireShark 2.4.1 or 2.4.13 capturing, unfiltered traffic we can see the DHCP offer:

enter image description here

Upgrading to WireShark 2.6.4 and performing the exact same capture, the DHCP Offer appears no more.

Upgrading to WireShark 3.0.0 yield the same result (no DHCP offer)

Opening with V2.6.4/3.0 the capture file made in V2.4.1, it is there.

Capturing with V2.6.4 / 3.0 then opening the capture in V2.4.1 it is still missing.

Install Wireshark 2.4.13 in a Mac OS VM , DHCP offer appears, copying (not installing) the WS 3.0 app in this VM, the DHCP offer still appears.

enter image description here

  • Thank you for the answer. Unfortunately it doesn't work in my case, I've tried to install 2.4.1 version of Wireshark and no luck. – deuter Mar 29 at 11:42
  • @deuter the issue is not actually with WireShark itself but with the capture driver that is installed by newer vesion. If you delete the wireshark app from your application folder then install V2.4.1 it does'nt work (I tried) because it doesn't downgrade the capture driver. You have to test either with a machine where WS was never installed or remove the capture driver manually. There's a readme file in the wirshark DMG that explains what is installed. – JFL Mar 29 at 13:03
  • I've checked with Windows machine and Wireshark 2.4.1 and I have no DHCP offer message as well. I didn't have any other Mac machine to test, so I'll check that tomorrow. – deuter Mar 31 at 19:01
  • I've checked it also with newly installed Wireshark 2.4.1 on Macbook and I have same situation - no DHCP offer captured. – deuter Apr 2 at 10:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.