‘Show me all the DHCP servers running on this network’

[root@shadowrun ~]# tshark -i eth0 -n port 68 -R 'bootp.type == 2'
...<snip>...
36.347674 192.168.200.11 -> 255.255.255.255 DHCP 342 DHCP Offer    - Transaction ID 0x45c2f96c
36.931708 192.168.200.25 -> 255.255.255.255 DHCP 342 DHCP Offer    - Transaction ID 0x45c2f96c
57.018616 192.168.200.11 -> 255.255.255.255 DHCP 342 DHCP Offer    - Transaction ID 0x7a7d114c
57.931998 192.168.200.25 -> 255.255.255.255 DHCP 342 DHCP Offer    - Transaction ID 0x7a7d114c
...</snip>...

Two DHCP servers?(!) That’s not good.

https://www.wireshark.org/docs/man-pages/tshark.html

https://wiki.wireshark.org/BOOTP

```TShark is a network protocol analyzer. It lets you capture packet data from a live network, or read packets from a previously saved capture file, either printing a decoded form of those packets to the standard output or writing the packets to a file. TShark’s native capture file format is pcap format, which is also the format used by tcpdump and various other tools.

```Without any options set, TShark will work much like tcpdump. It will use the pcap library to capture traffic from the first available network interface and displays a summary line on stdout for each received packet.