First time here? Check out the FAQ!

Ask Your Question
0

dhcp.bootp == 1 don't capture packet after update wireshark
 
  
 
  
 
 
 
 
 
 
    
        
        asked Dec 19 '0  
 
 RabbitZ gravatar image  
 
 
 
 
 
With previous version wireshark with filter "bootp.dhcp == 1", I can capture DHCP packet.
It prompt new vesion is available, and I update to new version (3.4.2-0), the filter change to "dhcp.bootp == 1",
nothing captured when I start my Ethernet device.
 
Any solution can I capture DHCP packet?
 
Preview: (hide)
 
 
 
 
          
 
add a comment
 
 
 
 
 
 1 Answer
    
 
 
                    Sort by »
                     oldest newest most voted 
 
 
 
 
 
  
 
 
 
 
0
 
 
  
 
 
 
 
 
 
 
 
    
        
        answered Dec 19 '0  
 
 Jaap gravatar image  
 
 
 
 
 
The display filter bootp.dhcp == 1 asks Wireshark 2.6 to show DHCP packets, while dhcp.bootp == 1 asks Wireshark 3.4 to show BOOTP packets. Since you are looking for (only) DHCP packets that last filter is incorrect, it should be dhcp && !dhcp.bootp
 
Preview: (hide)
 
 
 
 
         
        link
        
 
Comments
"dhcp && !dhcp.bootp" works, but I can't use "Display Filter Expression" to choose it, I manually type this expression.
Expression "dhcp.option.dhcp >= 1" can also works for capture DHCP packet.
RabbitZ gravatar imageRabbitZ (
    
        Dec 20 '0
    )
The best way (according to the RFF 2131) to distinguish DHCP from BOOTP is to use the following dhcp.cookie == 99.130.83.99.
Jaap gravatar imageJaap (
    
        Dec 20 '0
    )
add a comment
 
 
 
 
  
 
 
 
 

    
        Your Answer
    

 
 Please start posting anonymously - your entry will be published after you log in or create a new account.

    

 
 
Add Answer
 
 
 
 
 
 
 
 
   
  
 
   
 
 
 
 
 
 
 
 
Question Tools
  
 

        
        
            1 follower
        
    
 
 
 subscribe to rss feed 
 
 
 
 
 
 
Stats
 

        Asked:  Dec 19 '0  
 
 
        Seen: 1,121 times 
 

        Last updated: Dec 20 '20 
 
 
 
Related questions
 
 
 Windows Client keeps generating DHCP request 
 
 (DHCP) I don't receive REQUEST packet 
 
 Capturing my router login 
 
 Have a rogue DHCP server handing out an incorrect DNS entry 
 
 bad ip address - possible DHCP/DNS? 
 
 Why would DHCP Discovery, Request, Offer, ACK repeat 
 
 DHCP Option 43 
 
 DHCP request from a host to a DHCP server with the host having the same MAC address as that of the server 
 
 Trying to capture DHCP packets (discover, offer, request, ack) 
 
 NBNS, ICMP followed by DHCP