Step 1: Capture a Trace Click on the Wireshark Trace at . OR if you do not wish to follow step 1, you can proceed manually by opening Wireshark as follows: Start Wireshark by going to the bottom left of your Windows PC and typing “Wireshark” as shown in (a) on the left below. In some cases you are asked to upgrade, please click “skip this version” as highlighted below in (b). Launching Wireshark b. Skipping the option to upgrade. Once Wireshark starts, you are asked to pick a network interface. Choose Ethernet each time. Finally, you should end up with a Wireshark interface like below. Step 2: Inspect the Trace Look for the short DHCP exchange (of a DHCP Request packet followed by a DHCP Ack packet) in your trace. Select the DHCP Request packet, and observe the protocol stack to see how DHCP messages are carried. The link protocol is likely Ethernet, and the next higher protocol is IP. Then comes UDP, so each DHCP message is carried in a UDP packet. On top of UDP, Wireshark is likely to say BOOTP (Bootstrap Protocol) instead of DHCP. This is a bit confusing, but DHCP is implemented as an extension of an older protocol called BOOTP. You can think of the BOOTP section as the DHCP header and message. An window is shown below. Figure 2: Capture of DHCP packets, showing details of a DHCP Request Expand the BOOTP (DHCP) section (using the “+” expander or icon) to look at the details of a DHCP message. There are many fields, and we will only point out a few rather than cover them all. These fields are carried in all DHCP messages, though they have different values in different messages. The message begins with a Message Type. It is a Boot Request, which is used for all DHCP sent from your computer to a DHCP server.
Step 1: Capture a Trace Click on the Wireshark Trace at . OR if you do not wish to follow step 1, you can proceed manually by opening Wireshark as follows: Start Wireshark by going to the bottom left of your Windows PC and typing “Wireshark” as shown in (a) on the left below. In some cases you are asked to upgrade, please click “skip this version” as highlighted below in (b). Launching Wireshark b. Skipping the option to upgrade. Once Wireshark starts, you are asked to pick a network interface. Choose Ethernet each time. Finally, you should end up with a Wireshark interface like below. Step 2: Inspect the Trace Look for the short DHCP exchange (of a DHCP Request packet followed by a DHCP Ack packet) in your trace. Select the DHCP Request packet, and observe the protocol stack to see how DHCP messages are carried. The link protocol is likely Ethernet, and the next higher protocol is IP. Then comes UDP, so each DHCP message is carried in a UDP packet. On top of UDP, Wireshark is likely to say BOOTP (Bootstrap Protocol) instead of DHCP. This is a bit confusing, but DHCP is implemented as an extension of an older protocol called BOOTP. You can think of the BOOTP section as the DHCP header and message. An window is shown below. Figure 2: Capture of DHCP packets, showing details of a DHCP Request Expand the BOOTP (DHCP) section (using the “+” expander or icon) to look at the details of a DHCP message. There are many fields, and we will only point out a few rather than cover them all. These fields are carried in all DHCP messages, though they have different values in different messages. The message begins with a Message Type. It is a Boot Request, which is used for all DHCP sent from your computer to a DHCP server.