This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I did a capture and am asked to show the ARP data and he DHCP data and then show which one is from the client and which one is from the server.

How do I do this?

asked 09 Nov '14, 08:21

MacTavish_10's gravatar image

MacTavish_10
11224
accept rate: 0%

edited 09 Nov '14, 08:22


You should familiarize yourself with how ARP and DHCP works. In both cases the client is the one asking for something: ARP usually asks for a MAC address for a known IP address, while DHCP asks for an IP address to be assigned to an interface.

So if you see an ARP packet with "Who has... Tell..." it's the client. If you see a DHCP "Discover" it's the client, too.

permanent link

answered 09 Nov '14, 14:45

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×122
×78
×52
×44

question asked: 09 Nov '14, 08:21

question was seen: 3,012 times

last updated: 09 Nov '14, 14:45

p​o​w​e​r​e​d by O​S​Q​A