tcpdump

If a host is not getting an IP address, run a packet capture to see if DHCP traffic is being transmitted.

(ncn-mw#) Run tcpdump:

tcpdump -w dhcp.pcap -envli bond0.nmn0 port 67 or port 68

This will make a .pcap file named dhcp in the current directory. It will collect all DHCP traffic on the specified port. This example is looking for DHCP traffic on interface bond0.nmn0 (10.252.0.0/17).

(ncn-mw#) To view the DHCP traffic, run:

tcpdump -r dhcp.pcap -v -n

The output may be very long, in which case using filters is recommended.

(ncn-mw#) To do a tcpdump for a certain MAC address:

tcpdump -i eth0 -vvv -s 1500 '((port 67 or port 68) and (udp[38:4] = 0x993b7030))'

Note: This example is using the MAC address b4:2e:99:3b:70:30. It will show the output on the terminal and not save to a file.

Back to Index