decodedhcp

Decodes the DHCP packets.

Syntax

decodedhcp

Description

The output fields are as follows:

  • client_ip: IP address of the DHCP client. The address of any client which an IP address is not assigned is 0.0.0.0.
  • client_mac: MAC address of the DHCP client.
  • fingerprint: DHCP fingerprint if present. See the list of DHCP and BOOTP parameters managed by IANA for the meaning of each number: https://www.iana.org/assignments/bootp-dhcp-parameters/bootp-dhcp-parameters.xhtml
  • gateway_ip: Gateway IP address specified by the DHCP relay agent when communicating with the DHCP server on behalf of the client. Typically, the IP address at which the DHCP server can communicate with the DHCP agent.
  • next_server_ip: IP address of the secondary DHCP server
  • options: Field that displays the DHCP option numbers as an array
  • tx_id: DHCP transaction identifier
  • your_ip: IP address assigned by the DHCP server to the client

Usage

Decode DHCP packets from a pcap file.

pcapfile /opt/logpresso/pcap/dhcp.pcap | decodedhcp