topic Re: Using packet capture to view DHCP discover , offer , request and ACK packet in General Topics

Using packet capture to view DHCP discover , offer , request and ACK packet

fatboy1607 — Thu, 05 Nov 2015 08:11:32 GMT

how can we view DHCP discover , offer , request and ACK packet

Thanks in advance,

Re: Using packet capture to view DHCP discover , offer , request and ACK packet

Raido_Rattameister — Thu, 05 Nov 2015 10:42:40 GMT

You can see all if dhcp server and client are in diferent subnets so those packets pass Palo or if Palo itself is dhcp server.

If server and client are in same subnet then discover is broadcast but from then on server sends response directly to client and devices standing by don't see this (unless you use mirror port is switch).

Re: Using packet capture to view DHCP discover , offer , request and ACK packet

fatboy1607 — Thu, 05 Nov 2015 13:17:44 GMT

thanks but I am looking for specific command we can run on palo alto to view DORA exchange.

for example using tcpdump -i <interface> port 67 we get that information.

Re: Using packet capture to view DHCP discover , offer , request and ACK packet

OtakarKlier — Thu, 05 Nov 2015 15:50:44 GMT

You can setup a specific security rule to just look for the DHCP application. This way the traffic will display in the Traffic logs. Also if I remember my DHCP correctly, the client send the request to the DHCP server over port 67 but then the server replies over port 68.

Regards,

Re: Using packet capture to view DHCP discover , offer , request and ACK packet

BenjAudy.MTL — Sat, 07 Nov 2015 04:37:49 GMT

Hi,

You won't see the specific packets in the traffic logs, but if it's for diagnostic purpose, you can start a capture from the GUI and specify the DHCP ports as the filter. You will be able to download the resulting capture and analyze it in Wireshark.

Benjamin