This is our old Q&A Site. Please post any new questions and answers at

I’m pretty new to Wireshark and trying to TS an issue and want to prove that a PXE DHCP request isn’t being received by the Microsoft DHCP server. I thought it would be a case of:

  1. Start a capture on the DHCP server
  2. Kick off the boot process on the client, watch the PXE boot and note the mac address
  3. Stop the capture on the DHCP server and filter (eth.src.==xx.xx.xx.xx.xx.xx)
  4. If nothing shows then my point is proved.

Problem is, I’ve performed this on a client that is successfully obtaining an address and to see a positive result I repeated the process above but do not see any packets. I can see plenty of DHCP traffic. I’m just wondering of the source mac address will be the Cisco switch routing the request via the helper.

Any ideas how one can achieve what I’m trying to do?


asked 18 Sep '13, 17:37

plentymech's gravatar image

accept rate: 100%

I worked out the process myself now. I was doing it right but just played with the filters a little more and all was revealed.

permanent link

answered 18 Sep '13, 20:14

plentymech's gravatar image

accept rate: 100%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 18 Sep '13, 17:37

question was seen: 3,555 times

last updated: 18 Sep '13, 20:14

p​o​w​e​r​e​d by O​S​Q​A