hmm, I see this when requesting an ip using vista,
Code:
# tcpdump -i bridge0 port 67
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on bridge0, link-type EN10MB (Ethernet), capture size 96 bytes
10:24:38.545526 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:16:ea:25:76:b0 (oui Unknown), length 300
10:24:39.001127 IP fire.bootps > 255.255.255.255.bootpc: BOOTP/DHCP, Reply, length 300
10:24:42.111139 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:16:ea:25:76:b0 (oui Unknown), length 300
10:24:42.112175 IP fire.bootps > 255.255.255.255.bootpc: BOOTP/DHCP, Reply, length 300
10:24:50.427196 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:16:ea:25:76:b0 (oui Unknown), length 300
10:24:50.428296 IP fire.bootps > 255.255.255.255.bootpc: BOOTP/DHCP, Reply, length 300
10:25:07.493860 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:16:ea:25:76:b0 (oui Unknown), length 300
10:25:07.495414 IP fire.bootps > 255.255.255.255.bootpc: BOOTP/DHCP, Reply, length 300
and from pflog
Code:
2008-11-20 10:24:38.545322 rule 44/0(match): pass in on ath0: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:16:ea:25:76:b0, length 300
2008-11-20 10:24:38.545440 rule 42/0(match): pass out on bridge0: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:16:ea:25:76:b0, length 300
From a XP system I see this
Code:
# tcpdump -i bridge0 port 67
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on bridge0, link-type EN10MB (Ethernet), capture size 96 bytes
10:32:28.316675 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:19:db:04:86:9e (oui Unknown), length 300
10:32:29.001626 IP fire.bootps > 10.1.10.199.bootpc: BOOTP/DHCP, Reply, length 300
10:32:29.006178 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:19:db:04:86:9e (oui Unknown), length 326
10:32:29.009442 IP fire.bootps > 10.1.10.199.bootpc: BOOTP/DHCP, Reply, length 300
and in pflog
Code:
2008-11-20 10:32:28.316448 rule 44/0(match): pass in on ath0: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:19:db:04:86:9e, length 300
2008-11-20 10:32:28.316569 rule 42/0(match): pass out on bridge0: 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:19:db:04:86:9e, length 300
From what I can see they look pretty much the same to me.