A task came up once - to capture whether anything is going, and going at all, to a particular DHCP server. That is, whether requests to the DHCP server are arriving at all, and if so - with what delay (getting a bit off topic - the snag turned out to be on the 3Com 4900 side, which takes too long to notice a newly active port, and some network cards in PXE mode simply don't wait long enough).
Well, the first thing that comes to mind is - what? Riiight, tcpdump. But how do you correctly monitor traffic to DHCP via tcpdump without seeing everything else?
So:
1) We need to be on the DHCP server
2) We're interested in UDP traffic
3) We're interested in port 67 over that UDP
For example, say our network card is called eth0, then it will look like this:
$ sudo tcpdump -i eth0 -n udp and port 67
Comments