From mboxrd@z Thu Jan 1 00:00:00 1970 From: Micah Stetson To: 9fans@cse.psu.edu Subject: Re: [9fans] my cpu-in-vmware problem: it's weird :-) Message-ID: <20030423170858.GA2111@epaphras.inhouse.cnm-vra.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4i Date: Wed, 23 Apr 2003 10:08:58 -0700 Topicbox-Message-UUID: 9786d920-eacb-11e9-9e20-41e7f4b1d025 Presotto said: > 06:34:12.096343 0:50:56:cc:31:ba Broadcast ip 590: 172.16.189.254.bootpc > > 255.255.255.255.bootps: xid:0x7a2b9449 secs:8 C:172.16.189.254 file > ""[|bootp] ... > I don't know the output of tcpdump that well. Having a client address > (C:172.16.189.254) in a request is a sure sign of a renewal. However, > there should also be DHCP options in the packet. Does tcpdump not > print them? Then Ron Minnich said: > BTW snoopy gives much more useful output than tcpdump ... I have no doubt that snoopy is more straightforward and possibly more flexible than tcpdump, though I haven't had a chance to play with it, yet. But tcpdump can give better output than the above. By default, however, it only captures the first 68 bytes of every packet -- the [|bootp] at the end of the message means that the packet was truncated in the middle of the bootp information. If you add '-s 0' to the command line, it will capture whole packets and give you better output. Micah