What's the capture filter equivalent to the display filter "(bootp.option.type == 53)" for DHCP? asked 10 Nov '13, 18:25 metamatrix edited 11 Nov '13, 07:52 Kurt Knochner ♦ |
One Answer:
The order of option 53 in the frame, and with that the position, is unknown. As capture filters don't have any protocol intelligence, you can't define a capture filter for a certain DHCP option. The best thing you can do: Capture all DHCP/BOOTP frames and later use a display filter in Wireshark or tshark to filter only those frames with option 53. Wireshark display filter
Alternatively, you can use tshark with a display filter while you are capturing. Downside: you can't write a capture file (-w not supported with display filters). But you can print whatever fields you may need.
Replace xxxx with whatever bootp protocol field you may need. Regards answered 11 Nov '13, 07:55 Kurt Knochner ♦ |
Thank you,Kurt. If I just want to filter all the DHCP/bootp frames, then what's the appropriate capture filter?
should work.