在Wireshark中没有捕获DHCPOFFER消息

Question

我在寻找为什么Wireshark中的数据包捕获不包含DHCP提供消息的答案。我试图用安装的Wireshark直接在计算机上捕获数据包，并执行SPAN监视器端口。

在这两种情况下，我都无法在下面的屏幕上看到DHCP的报价：

我在MacOS Mojave上使用Wireshark2.6.4。

下面是具有拓扑结构的简单图：

以下是交换机配置：

interface Vlan47
 ip address x.x.x.1 255.255.255.0
!
interface Vlan49
 ip address x.x.x.1 255.255.255.0
 ip helper-address x.x.x.55
!
SPAN monitor destination interface
 switchport access vlan 21
 switchport mode access
 switchport nonegotiate
 switchport block unicast
 no logging event link-status
 access-session port-control auto
 mab
 dot1x pae authenticator
 dot1x timeout tx-period 3
 storm-control broadcast level 2.00
 storm-control multicast level 5.00
 storm-control action trap
 spanning-tree portfast
 service-policy type control subscriber policy_name
 ip dhcp snooping limit rate 100
!
SPAN monitor source port
 switchport access vlan 49
 switchport mode access
 switchport nonegotiate
 switchport block unicast
 switchport port-security maximum 2
 switchport port-security maximum 1 vlan access
 switchport port-security violation restrict
 switchport port-security aging time 2
 switchport port-security aging type inactivity
 switchport port-security
 no logging event link-status
 mab
 dot1x pae authenticator
 dot1x timeout tx-period 3
 access-session port-control force-authorized
 storm-control broadcast level 2.00
 storm-control multicast level 5.00
 storm-control action trap
 spanning-tree portfast
 service-policy type control subscriber policy_name
 ip verify source
 ip dhcp snooping limit rate 100
!
DHCP server port
interface Port-channel1
 switchport trunk allowed vlan 47,70
 switchport mode trunk
 switchport nonegotiate
 switchport block unicast
 ip arp inspection trust
 ip arp inspection limit rate 100
 logging event link-status
 storm-control broadcast level 5.00
 storm-control multicast level 10.00
 storm-control action trap
 ip dhcp snooping limit rate 1000
 ip dhcp snooping trust
!
!
sh monit sess all
Session 1
---------
Type                     : Local Session
Source Ports             :
    Both                 : SPAN source port
Destination Ports        : SPAN dst port
    Encapsulation        : Native
          Ingress        : Disabled
!
!

Answer 1

这是WireShark捕获驱动程序的最新版本的错误/限制。

在MacOs Mojave 10.14.3或10.14.4上，使用WireShark 2.4.1或2.4.13捕获未经过滤的流量，我们可以看到DHCP提供的：

升级到WireShark 2.6.4，并执行完全相同的捕获，DHCP提供的似乎不再。

升级到WireShark 3.0.0会产生相同的结果(不提供DHCP )

用V2.6.4/3.0打开在V2.4.1中生成的捕获文件，它就在那里。

使用V2.6.4 / 3.0进行捕获，然后在V2.4.1中打开捕获，它仍然缺少。

在Mac中安装Wireshark 2.4.13，就会出现DHCP提供，在这个VM中复制(而不是安装)WS3.0应用程序，DHCP仍然会出现。