dhcpdump - Man Page

dhcpdump [-h regular-expression] [-H] [-t] [-Z user] -i interface

dhcpdump [-h regular-expression] [-H] [-t] [-Z user] -r pcapfile

This command listens on a network interface to display the dhcp-packets for easier checking and debugging.

dhcpdump -i eth0

If you want to filter a specific Client Hardware Address (CHADDR), then you can specify it as a regular expression:

dhcpdump -i eth0 -h ^00:c0:4f

This will display only the packets with Client Hardware Addresses which start with 00:c0:4f.

The expression is matched against the full 16 byte CHADDR field formatted as colon separated hex pairs, so a 6 byte Ethernet address is followed by ten :00 pairs; anchored expressions need to account for that (^00:c0:4f matches, 4f:82:ac:7f$ does not).

Option -H will additionally show full packet hex dump.

Instead of getting live data from an interface, a pcap dump file can be used:

dhcpdump -r pcapfile

Opening an interface needs privileges, but decoding packets does not, and those packets come from anyone able to reach the network. Option -Z drops to an unprivileged user once the capture handle is open, so the decoder never runs as root:

dhcpdump -i eth0 -Z nobody

The supplementary groups, the group id and the user id are all changed, and the drop is verified to be irreversible before any packet is read.

Option -t switches to an interactive full-screen view that groups packets into sessions by client hardware address, and within each client into transactions by transaction id (XID). Each transaction lists its messages (for example DISCOVER, OFFER, REQUEST, ACK) and a derived, colour coded state: wait (a request is still awaiting its reply), offered, complete (bound), NAK, declined (the client refused the address, e.g. found it in use), or timeout (a reply never arrived in time). Repeated retransmissions are collapsed with a count, and an offer from a server the client did not ultimately pick is shown in yellow.

With -i the view updates live as packets arrive; with -r the whole capture is loaded first and then browsed. The -h filter applies here too, restricting which clients are tracked. Clients are shown in a stable first-seen order so the list does not reshuffle as traffic arrives.

The view has two panes. In the client list on the left/top select a client, then move into the detail pane to pick one of its packets, then open the full decode of that packet - the same detail the line mode prints.

The following keys are available:

q, Ctrl-C - quit (from any view)

h, H, ?, F1 - toggle a help dialog listing the keys for the current pane

v, V - toggle between side-by-side and top/bottom layouts

u / a - use UTF-8 box glyphs / plain ASCII

Ctrl-L - redraw the screen

Ctrl-Z - suspend; resume with the shell's job control (fg)

In the client list:

j / k, Down / Up - select a client

g / G, Home / End, PgUp / PgDn - jump / page

Right, Enter - move into the detail pane

Tab, Shift-Tab - move into the detail pane

In the detail pane:

j / k, Down / Up, PgUp / PgDn - select a packet

Left, Esc, Backspace - back to the client list

Tab, Shift-Tab - back to the client list

Right, Enter - open the full decode of the selected packet

In the packet decode:

Left / Right - previous / next packet

Up / Down, PgUp / PgDn - scroll

< / > - pan horizontally when the decode is wider than the screen

Esc, Backspace - back to the detail pane

  TIME: 2026-08-02 15:45:02.084
    IP: 0.0.0.0 (00:c0:4f:82:ac:7f) > 255.255.255.255 (ff:ff:ff:ff:ff:ff)
    OP: 1 (BOOTPREQUEST)
 HTYPE: 1 (Ethernet)
  HLEN: 6
  HOPS: 0
   XID: 28f61b03
  SECS: 0
 FLAGS: 0
CIADDR: 0.0.0.0
YIADDR: 0.0.0.0
SIADDR: 0.0.0.0
GIADDR: 0.0.0.0
CHADDR: 00:c0:4f:82:ac:7f:00:00:00:00:00:00:00:00:00:00
 SNAME:
 FNAME:
OPTION:  53 (  1) DHCP message type         3 (DHCPREQUEST)
OPTION:  54 (  4) DHCP Server identifier    130.139.64.101
OPTION:  50 (  4) Requested IP address      130.139.64.143
OPTION:  55 (  4) Parameter Request List
                  1   (Subnet mask)
                  3   (Router)
                  58  (Renewal Time T1)
                  59  (Rebinding Time T2)

At the option field, the first field is the value of the option, the second one (between brackets) is the length of the option-datafield, the third field is the name of the option, the fourth field is the data of the option.

0 on a normal run, 1 on any error: bad usage, capture setup failure, or a live capture that dies mid-run.

Privileged access is often needed for accessing the interface. Use -Z to give those privileges up again as soon as the interface is open.

Only Ethernet captures are supported. Notably, the Linux any pseudo-interface does not capture in Ethernet framing and is rejected; capture on a specific interface instead.

Not all the parameter options are printed verbose, because of lack of documentation. Not all the options are tested, because of lack of clients/servers with these options. If you have a dump of one of them, please send them to me and I'll incorporate them.

Ralph Droms and Ted Lemons "The DHCP Handbook", ISBN 1-57870-137-6.

Peter Apian-Bennewitz <apian@ise.fhg.de> for his Client Hardware Address filtering

Edwin Groothuis, edwin@mavetju.org (http://www.mavetju.org)

dhcpd(8), tcpdump(1), RFC2132