This is our old Q&A Site. Please post any new questions and answers at

Hi all, Sory I'm new to this and I'm trying to analyse the DHCP packets between clients and the servers. I don't have that much information on the whole network. Will using bootp filter helps me to put together the whole flow ?

I can see thet 192.168.70.x are coming form clients and seems to be the DHCP server ?

alt text

asked 05 Nov '16, 08:39

doran_lum's gravatar image

accept rate: 0%

That's it.

You can just use the display filter: bootp

permanent link

answered 05 Nov '16, 14:00

Amato_C's gravatar image

accept rate: 14%

You can see the DHCP messages:

DHCP Discover - Client to server

DHCP Inform - Client to server

DHCP ACK - Server to Client

Further infos you can find here:

permanent link

answered 05 Nov '16, 15:20

Christian_R's gravatar image

accept rate: 16%

edited 05 Nov '16, 15:21

You can also add the ethernet address(eth.addr) of the client and using "bootp". This will be a better filter as your nic might also capture Dhcp messages of other devices in the network.

permanent link

answered 06 Nov '16, 23:09

koundi's gravatar image

accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 05 Nov '16, 08:39

question was seen: 3,599 times

last updated: 06 Nov '16, 23:09

p​o​w​e​r​e​d by O​S​Q​A