This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Show the ARP data and the DHCP data and show which data is from the client and which from the server?

0

I did a capture and am asked to show the ARP data and he DHCP data and then show which one is from the client and which one is from the server.

How do I do this?

asked 09 Nov '14, 08:21

MacTavish_10's gravatar image

MacTavish_10
11224
accept rate: 0%

edited 09 Nov '14, 08:22


One Answer:

0

You should familiarize yourself with how ARP and DHCP works. In both cases the client is the one asking for something: ARP usually asks for a MAC address for a known IP address, while DHCP asks for an IP address to be assigned to an interface.

So if you see an ARP packet with "Who has... Tell..." it's the client. If you see a DHCP "Discover" it's the client, too.

answered 09 Nov '14, 14:45

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%