Tcpdump: capture DHCP & DHCPv6 packets - howtouselinux

PHOTO EMBED

Sat Apr 23 2022 09:29:57 GMT+0000 (Coordinated Universal Time)

Saved by @xiaomian 

How to use tcpdump to filter dhcp packets v4?
DHCP v4 traffic operates on port 67 (Server) and port 68 (Client). So we can capture the appropriate traffic with the following expression. (v4)

tcpdump -i eth0 udp port 67 and port 68 -vvv

How to use tcpdump to filter dhcpv6 packets?
DHCPv6 uses UDP port number 546 for clients and port number 547 for servers.

tcpdump -i eth0 -n -vv ‘(udp port 546 and port 547)’

How to use tcpdump to filter dhcp packets based on MAC address?
tcpdump -i eth0 -vvv -s 1500 ‘((port 67 or port 68) and (udp[38:4] = 0x3e0ccf08))’

Related post:
content_copyCOPY

https://www.howtouselinux.com/post/tcpdump-capture-dhcp-dhcpv6-packets