tcpdump - dhcp

Hi All,

How does one filter out dhcp traffic only.

The closest I've gotten is:

"tcpdump broadcast"

Thanks
Warrick

On 2005-03-08, Warrick FitzGerald <(E-Mail Removed)> wrote:
> How does one filter out dhcp traffic only.

Try filtering only arp packets.
Davide

--
Yo-yo operating system = WinNT: it goes up..., it goes down..., it goes...
-- From a Slashdot.org post

Warrick FitzGerald wrote:

> Hi All,
>
> How does one filter out dhcp traffic only.

How about this one:

tcpdump -i eth0 -n port 67 and port 68

Regards
Kimmo Koivisto

Kimmo Koivisto wrote:

>Warrick FitzGerald wrote:
>
>
>
>>Hi All,
>>
>>How does one filter out dhcp traffic only.
>>
>>
>
>How about this one:
>
>tcpdump -i eth0 -n port 67 and port 68
>
>Regards
>Kimmo Koivisto
>
>
Wow, thanks Kimmo. Id always thought of DHCP at the same layer as ICMP.
The fact that this works would indicate that it's wrapped in a tcp right?

Thanks again
Warrick

Warrick FitzGerald wrote:
> Kimmo Koivisto wrote:
>
>> Warrick FitzGerald wrote:
>>
>>
>>
>>> Hi All,
>>>
>>> How does one filter out dhcp traffic only.
>>>
>>
>>
>> How about this one:
>>
>> tcpdump -i eth0 -n port 67 and port 68
>>
>> Regards
>> Kimmo Koivisto
>>
>>
> Wow, thanks Kimmo. Id always thought of DHCP at the same layer as ICMP.
> The fact that this works would indicate that it's wrapped in a tcp right?
>

No - UDP ports 67 and 68, originally used by BOOTP. DHCP is
an extension to the BOOTP protocol.

--

Tauno Voipio
tauno voipio (at) iki fi