4
用tcpdump把整個封包錄下來看你就會知道282指是第幾個Byte
wireshark是把L2層以上的封包完整的顯示出來,所以要過濾DHCP封包要解好幾層
每一層header都有定義的長度加一加就是282這個位置,然後DHCP的option格式是有自訂表頭與長度
才要再取3byte判斷,是否是需要的欄位種類,DHCP的表頭id如下
53:'DHCP Message Type',
54:'DHCP Server Identifier',
51:'IP Address Lease Time',
1:'Subnet Mask',
15:'Domain Name',
3:'Router',
6:'Domain Name Server',
58:'Renewal Time Value',
59:'Rebinding Time Value',
60:'Vendor class identifier',
61:'Client identifier',
116:'DHCP Auto-Configuration',
55:'Parameter Request List',
43:'Vendor-Specific Information',
50:'Requested IP Address',
12:'Host Name'