DHCPDUMP(8)

📦
version 2.00 · 11 versions
, in ubuntu stonking

💖 DHCPDUMP(8) — the dhcpdump bestie guide 💖

okay so. bestie. you know how DHCP is just out here doing the MOST at 3am with no one watching? dhcpdump is the girl who's WATCHING. she's part of User Contributed Software and she is so good at her job, no cap. 💅

✨ NAME ✨

dhcpdump — the DHCP packet dumper. iconic behaviour, honestly. 🎀

🦋 SYNOPSIS 🦋

dhcpdump [-h regular-expression] [-H] [-t] [-Z user] -i interface

dhcpdump [-h regular-expression] [-H] [-t] [-Z user] -r pcapfile

two whole modes, one queen. 👑

🌸 DESCRIPTION 🌸

so basically this command parks itself on a network interface and displays the dhcp-packets so you can actually check things and debug them. it's giving "I'm the reason you found the bug at 2am". ✨

🌈 USAGE 🌈

classic starter move:

dhcpdump -i eth0

now. say you wanna filter for one specific Client Hardware Address (CHADDR). you just hand it a regular expression, like this:

dhcpdump -i eth0 -h ^00:c0:4f

that right there shows you only the packets whose Client Hardware Addresses start with 00:c0:4f. obsessed. 💖

important tea though: the expression gets matched against the full 16 byte CHADDR field, formatted as colon separated hex pairs. so a 6 byte Ethernet address is followed by ten ":00" pairs. what that means for you is that anchored expressions HAVE to account for that — "^00:c0:4f" matches, but "4f:82:ac:7f$" does not. anchor responsibly, bestie. 😭

option -H will additionally show you the full packet hex dump. yes, the whole thing. the full lore. 🙈

and instead of getting live data from an interface, you can use a pcap dump file:

dhcpdump -r pcapfile

now for the responsible queen section 👑 — opening an interface needs privileges, but decoding packets does not, and those packets come from literally anyone able to reach the network. so option -Z drops down to an unprivileged user once the capture handle is open, so that the decoder never runs as root:

dhcpdump -i eth0 -Z nobody

the supplementary groups, the group id AND the user id are all changed, and the drop is verified to be irreversible before any packet is read. that's the safety arc. we love to see it. 🫶

🎀 TUI (SESSION TRACKING) 🎀

option -t switches you into an interactive full-screen view. main character energy fr fr. it groups packets into sessions by client hardware address, and then within each client into transactions by transaction id (XID).

each transaction lists its messages (for example DISCOVER, OFFER, REQUEST, ACK) and a derived, colour coded state:

  • wait — a request is still awaiting its reply
  • offered
  • complete (bound)
  • NAK
  • declined — the client refused the address, e.g. found it in use
  • timeout — a reply never arrived in time

repeated retransmissions are collapsed with a count, and an offer from a server the client did not ultimately pick is shown in yellow. shady? a little. informative? absolutely. 💀

with -i the view updates live as packets arrive; with -r the whole capture is loaded first and then browsed. the -h filter applies here too, restricting which clients are tracked. and clients are shown in a stable first-seen order so the list does not reshuffle as traffic arrives — no chaotic jumping, we're not doing that today. ✨

the view has two panes. in the client list on the left/top you select a client, then move into the detail pane to pick one of its packets, then open the full decode of that packet — the same detail the line mode prints. that's the whole journey, slay. 💅

the following keys are available, and I need you to READ them, bestie:

  • q, Ctrl+C — quit (from any view)
  • h, H, ?, F1 — toggle a help dialog listing the keys for the current pane
  • v, V — toggle between side-by-side and top/bottom layouts
  • u / a — use UTF-8 box glyphs / plain ASCII
  • Ctrl+L — redraw the screen
  • Ctrl+Z — suspend; resume with the shell's job control (fg)

🧚 In the client list 🧚

  • j / k, Down / Up — select a client
  • g / G, Home / End, PgUp / PgDn — jump / page
  • Right, Enter — move into the detail pane
  • Tab, Shift-Tab — move into the detail pane

💜 In the detail pane 💜

  • j / k, Down / Up, PgUp / PgDn — select a packet
  • Left, Esc, Backspace — back to the client list
  • Tab, Shift-Tab — back to the client list
  • Right, Enter — open the full decode of the selected packet

🍓 In the packet decode 🍓

  • Left / Right — previous / next packet
  • Up / Down, PgUp / PgDn — scroll
  • < / > — pan horizontally when the decode is wider than the screen
  • Esc, Backspace — back to the detail pane

⭐ OUTPUT ⭐

here's the whole vibe in one screenshot, bestie:

  TIME: 2026-08-02 15:45:02.084
    IP: 0.0.0.0 (00:c0:4f:82:ac:7f) > 255.255.255.255 (ff:ff:ff:ff:ff:ff)
    OP: 1 (BOOTPREQUEST)
 HTYPE: 1 (Ethernet)
  HLEN: 6
  HOPS: 0
   XID: 28f61b03
  SECS: 0
 FLAGS: 0
CIADDR: 0.0.0.0
YIADDR: 0.0.0.0
SIADDR: 0.0.0.0
GIADDR: 0.0.0.0
CHADDR: 00:c0:4f:82:ac:7f:00:00:00:00:00:00:00:00:00:00
 SNAME:
 FNAME:
OPTION:  53 (  1) DHCP message type         3 (DHCPREQUEST)
OPTION:  54 (  4) DHCP Server identifier    130.139.64.101
OPTION:  50 (  4) Requested IP address      130.139.64.143
OPTION:  55 (  4) Parameter Request List
                  1   (Subnet mask)
                  3   (Router)
                  58  (Renewal Time T1)
                  59  (Rebinding Time T2)

okay so at the option field — the first field is the value of the option, the second one (between brackets) is the length of the option-datafield, the third field is the name of the option, and the fourth field is the data of the option. four fields. locked in. 💯

🦋 RETURN VALUES 🦋

  • 0 — on a normal run
  • 1 — on any error: bad usage, capture setup failure, or a live capture that dies mid-run

🔥 NOTES 🔥

privileged access is often needed for accessing the interface. use -Z to give those privileges up again as soon as the interface is open. that's the whole point. do it. 🫶

Only Ethernet captures are supported. notably, the Linux any pseudo-interface does not capture in Ethernet framing and is rejected. so capture on a specific interface instead. no workarounds, bestie, just pick the actual NIC. 😭

💀 BUGS 💀

not all the parameter options are printed verbose, because of lack of documentation. not all the options are tested, because of lack of clients/servers with these options. if you have a dump of one of them, please send them to me and I'll incorporate them. genuinely — if you've got the receipts, send the receipts. 📬

🌸 THANKS TO 🌸

  • Ralph Droms and Ted Lemons "The DHCP Handbook", ISBN 1-57870-137-6.
  • Peter Apian-Bennewitz <apian@ise.fhg.de> for his Client Hardware Address filtering. 🫶

👑 AUTHOR 👑

Edwin Groothuis, edwin@mavetju.org (http://www.mavetju.org). the icon. the legend. 💅

🌈 SEE ALSO 🌈

dhcpd(8), tcpdump(1), RFC2132

okay and that's the whole page — this is perl v5.40.1 energy, dated 29 July 2026, and honestly? it ate. 🎀✨ periodt. 🦋

📦 where this page comes from