'what is the correct tshark capture filter option for the DHCP frame?

I am trying to capture the DHCP frames for analysis using the following command in my mac book.

sudo tshark -i en0 -f "port 67 or port 68" -a duration:300 -w /tmp/dump.pcap

I use the following command to get all the fields of all protocols in the packet but it is not printing any value. Is the capture filter option for the DHCP frame is correct? Any help is appreciated?

sudo tshark -T text -r /tmp/dump.pcap -V
linuxnetworkingwiresharkwirelesstshark


Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source

Related Questions