Using packet capture to view DHCP discover , offer , request and ACK packet

[fatboy1607]

how can we view DHCP discover , offer , request and ACK packet 

Thanks in advance,

[Raido_Rattameister]

You can see all if dhcp server and client are in diferent subnets so those packets pass Palo or if Palo itself is dhcp server.

If server and client are in same subnet then discover is broadcast but from then on server sends response directly to client and devices standing by don't see this (unless you use mirror port is switch).

[fatboy1607]

thanks but I am looking for specific command we can run on palo alto to view DORA exchange.

for example using tcpdump -i <interface> port 67 we get that information.

[OtakarKlier]

You can setup a specific security rule to just look for the DHCP application. This way the traffic will display in the Traffic logs. Also if I remember my DHCP correctly, the client send the request to the DHCP server over port 67 but then the server replies over port 68.

Regards,

[BenjAudy.MTL]

Hi,

You won't see the specific packets in the traffic logs, but if it's for diagnostic purpose, you can start a capture from the GUI and specify the DHCP ports as the filter. You will be able to download the resulting capture and analyze it in Wireshark.

Benjamin