There are a lot of "BOOTP/DHCP, Request" in tcpdump and I would like to filter it out.
It's easy to filter arp out.
tcpdump -nni eth0 not arp
What about BOOTP/DHCP, Request
?
I've tried the following but it doesn't work
$ sudo tcpdump -nni eth0 not bootp
tcpdump: can't parse filter expression: syntax error
$ sudo tcpdump -nni eth0 not dhcp
tcpdump: can't parse filter expression: syntax error
$ sudo tcpdump -nni eth0 not dhcpd
tcpdump: can't parse filter expression: syntax error
What is the right tcpdump for this?
'not (udp port 67 or udp port 68)'
. – berndbausch Mar 20 '21 at 01:47