tcpdump -i enahisic2i3 udp and port 67 or port 68 or port 69 and ether src 1c:ae:cb:eb:91:e6
还有tcpdump -i 网卡名 -s0 -A -vv ether src mac地址
[root@bogon ~]# tcpdump -i enahisic2i3 udp and port 67 or port 68 or port 69 and ether src F4:1D:6B:F8:7A:58 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on enahisic2i3, link-type EN10MB (Ethernet), capture size 262144 bytes 15:28:49.791464 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from f4:1d:6b:f8:7a:58 (oui Unknown), length 347 15:28:53.275777 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from f4:1d:6b:f8:7a:58 (oui Unknown), length 359 15:28:53.311857 IP 172.16.100.108.iad1 > bogon.tftp: 41 RRQ "grubx64.efi" octet tsize 0 blksize 1468 15:28:53.347358 IP 172.16.100.108.iad2 > bogon.tftp: 33 RRQ "grubx64.efi" octet blksize 1468 15:30:56.774038 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from f4:1d:6b:f8:7a:58 (oui Unknown), length 347 15:31:00.279235 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from f4:1d:6b:f8:7a:58 (oui Unknown), length 359 15:31:00.314576 IP 172.16.100.108.iad3 > bogon.tftp: 41 RRQ "grubx64.efi" octet tsize 0 blksize 1468 15:31:00.346974 IP 172.16.100.108.netinfo-local > bogon.tftp: 33 RRQ "grubx64.efi" octet blksize 1468
[root@bogon ~]# tcpdump -i enahisic2i3 udp and port 67 or port 68 or port 69 and ether src F4:1D:6B:F8:7A:58 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on enahisic2i3, link-type EN10MB (Ethernet), capture size 262144 bytes 16:03:22.616685 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from f4:1d:6b:f8:7a:58 (oui Unknown), length 347 16:03:26.105009 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from f4:1d:6b:f8:7a:58 (oui Unknown), length 359 16:03:26.140694 IP 172.16.100.101.livelan > bogon.tftp: 41 RRQ "bootx64.efi" octet tsize 0 blksize 1468 16:03:26.173593 IP 172.16.100.101.veritas_pbx > bogon.tftp: 33 RRQ "bootx64.efi" octet blksize 1468 16:03:26.437432 IP 172.16.100.101.arbortext-lm > bogon.tftp: 32 RRQ "grubx64.efi" octet blksize 512 16:05:33.589005 IP 172.16.100.101.xingmpeg > bogon.tftp: 33 RRQ "bootx64.efi" octet blksize 1468 16:05:33.931538 IP 172.16.100.101.web2host > bogon.tftp: 32 RRQ "grubx64.efi" octet blksize 512
[root@bogon ~]# tcpdump -i enahisic2i3 udp and port 67 or port 68 or port 69 and ether src F4:1D:6B:F8:7A:58 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on enahisic2i3, link-type EN10MB (Ethernet), capture size 262144 bytes 16:11:53.074306 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from f4:1d:6b:f8:7a:58 (oui Unknown), length 347 16:11:56.562619 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from f4:1d:6b:f8:7a:58 (oui Unknown), length 359 16:11:56.597917 IP 172.16.100.101.rdb-dbs-disp > bogon.tftp: 41 RRQ "bootx64.efi" octet tsize 0 blksize 1468 16:11:56.630810 IP 172.16.100.101.chip-lm > bogon.tftp: 33 RRQ "bootx64.efi" octet blksize 1468 16:11:56.883159 IP 172.16.100.101.itscomm-ns > bogon.tftp: 32 RRQ "grubx64.efi" octet blksize 512 16:11:57.204639 IP 172.16.100.101.25300 > bogon.tftp: 60 RRQ "/grub.cfg-01-f4-1d-6b-f8-7a-58" octet blksize 1024 tsize 0 16:11:57.205811 IP 172.16.100.101.25301 > bogon.tftp: 48 RRQ "/grub.cfg-AC106465" octet blksize 1024 tsize 0 16:11:57.207284 IP 172.16.100.101.25302 > bogon.tftp: 47 RRQ "/grub.cfg-AC10646" octet blksize 1024 tsize 0 16:11:57.208382 IP 172.16.100.101.25303 > bogon.tftp: 46 RRQ "/grub.cfg-AC1064" octet blksize 1024 tsize 0 16:11:57.209427 IP 172.16.100.101.25304 > bogon.tftp: 45 RRQ "/grub.cfg-AC106" octet blksize 1024 tsize 0 16:11:57.210433 IP 172.16.100.101.25305 > bogon.tftp: 44 RRQ "/grub.cfg-AC10" octet blksize 1024 tsize 0 16:11:57.211523 IP 172.16.100.101.25306 > bogon.tftp: 43 RRQ "/grub.cfg-AC1" octet blksize 1024 tsize 0 16:11:57.212594 IP 172.16.100.101.25307 > bogon.tftp: 42 RRQ "/grub.cfg-AC" octet blksize 1024 tsize 0 16:11:57.213635 IP 172.16.100.101.25308 > bogon.tftp: 41 RRQ "/grub.cfg-A" octet blksize 1024 tsize 0 16:11:57.214681 IP 172.16.100.101.25309 > bogon.tftp: 39 RRQ "/grub.cfg" octet blksize 1024 tsize 0 16:11:57.215682 IP 172.16.100.101.25310 > bogon.tftp: 71 RRQ "/EFI/centos/grub.cfg-01-f4-1d-6b-f8-7a-58" octet blksize 1024 tsize 0 16:11:57.216815 IP 172.16.100.101.25311 > bogon.tftp: 59 RRQ "/EFI/centos/grub.cfg-AC106465" octet blksize 1024 tsize 0 16:11:57.218085 IP 172.16.100.101.25312 > bogon.tftp: 58 RRQ "/EFI/centos/grub.cfg-AC10646" octet blksize 1024 tsize 0 16:11:57.219156 IP 172.16.100.101.25313 > bogon.tftp: 57 RRQ "/EFI/centos/grub.cfg-AC1064" octet blksize 1024 tsize 0 16:11:57.220251 IP 172.16.100.101.25314 > bogon.tftp: 56 RRQ "/EFI/centos/grub.cfg-AC106" octet blksize 1024 tsize 0 16:11:57.221364 IP 172.16.100.101.25315 > bogon.tftp: 55 RRQ "/EFI/centos/grub.cfg-AC10" octet blksize 1024 tsize 0 16:11:57.222409 IP 172.16.100.101.25316 > bogon.tftp: 54 RRQ "/EFI/centos/grub.cfg-AC1" octet blksize 1024 tsize 0 16:11:57.223443 IP 172.16.100.101.25317 > bogon.tftp: 53 RRQ "/EFI/centos/grub.cfg-AC" octet blksize 1024 tsize 0 16:11:57.224471 IP 172.16.100.101.25318 > bogon.tftp: 52 RRQ "/EFI/centos/grub.cfg-A" octet blksize 1024 tsize 0 16:11:57.225550 IP 172.16.100.101.25319 > bogon.tftp: 50 RRQ "/EFI/centos/grub.cfg" octet blksize 1024 tsize 0 16:11:57.226752 IP 172.16.100.101.25320 > bogon.tftp: 64 RRQ "/EFI/centos/x86_64-efi/command.lst" octet blksize 1024 tsize 0 16:11:57.227846 IP 172.16.100.101.25321 > bogon.tftp: 59 RRQ "/EFI/centos/x86_64-efi/fs.lst" octet blksize 1024 tsize 0 16:11:57.228820 IP 172.16.100.101.25322 > bogon.tftp: 63 RRQ "/EFI/centos/x86_64-efi/crypto.lst" octet blksize 1024 tsize 0 16:11:57.229891 IP 172.16.100.101.25323 > bogon.tftp: 65 RRQ "/EFI/centos/x86_64-efi/terminal.lst" octet blksize 1024 tsize 0 16:11:57.230840 IP 172.16.100.101.25324 > bogon.tftp: 50 RRQ "/EFI/centos/grub.cfg" octet blksize 1024 tsize 0 16:12:03.075263 IP 172.16.100.101.25325 > bogon.tftp: 59 RRQ "/tftpboot/172.16.100.101.conf" octet blksize 1024 tsize 0 16:12:06.989379 IP 172.16.100.101.25326 > bogon.tftp: 80 RRQ "a6995cce-9892-485c-a343-1c80416ec1b1/deploy_kernel" octet blksize 1024 tsize 0 16:12:07.392601 IP 172.16.100.101.25327 > bogon.tftp: 81 RRQ "a6995cce-9892-485c-a343-1c80416ec1b1/deploy_ramdisk" octet blksize 1024 tsize 0
16:12:07.392601 IP 172.16.100.101.25327 > bogon.tftp: 81 RRQ "a6995cce-9892-485c-a343-1c80416ec1b1/deploy_ramdisk" octet blksize 1024 tsize 0 16:13:33.787707 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from f4:1d:6b:f8:7a:58 (oui Unknown), length 300 16:13:33.788173 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from f4:1d:6b:f8:7a:58 (oui Unknown), length 300 ^C