Examining the output of a Wireshark captureĥ: If you don’t see the packet details in the Wireshark window, select View and make sure that Packet Details is selected in the drop-down. Adjusting a Wireshark display filter by typing in the filter dialogue boxĤ: To complete the filter (in the next image) I’ve added “or eth.dst = d4:81:d7:fd:d5:ee or dhcp” although the expression ” eth.addr = d4:81:d7:fd:d5:ee or dhcp” would have achieved the same output. Applying a Wireshark Filter by right-clicking the field in a displayed packetģ: Amend the filter until it includes what’s needed, you can select other fields as above and add them using the “.or Selected”, or you can type directly in the filter box. Right-clicking on the MAC address of the PXE client and highlighting “Apply as Filter” then clicking on selected will populate the display filter box at the top of the capture. The simplest way to do that is to right-click the desired field in the packet of interest.

You can start to filter using the display filter options. Starting a Wireshark capture on a selected interface with no capture filter Applying display filters to a Wireshark captureĢ: Once you’ve stopped the capture, save the file for future use. We could have used the MAC address of the PXE client in the Capture Filter box as “ether host a1:b2:c3:d4:cf:0c” for example, I’d include “ether host ff:ff:ff:ff:ff:ff” so as not to miss the broadcast element of the capture.Ĭlick on the Start button to begin the capture. We knew the MAC address of the client machine, and the Wireshark laptop so after tracing the MAC addresses to their respective switch ports and setting up port mirroring, we were good to start the capture.ġ: Start Wireshark and choose (1) Capture and choose Options, then select (2) Promiscuous Mode for the capture interface and make sure there is no capture filter. Since we couldn’t have Wireshark installed on the client or the server, the capture was performed on a third device. In this scenario, the PXE boot and build process stopped working so we needed to find out what the problem was. The client needs to be configured to boot from the network either after failing to boot from other sources or, as is often the case because it needs a rebuild and the build-media is held on a network drive.

PXE boot is the process of booting a network-connected device from the network using the Preboot eXecution Environment.

In this blog we’re going to cover troubleshooting PXE Boot with Wireshark, in this case, we have an existing capture of a PXE boot issue.

Wireshark filter on protocol