ISC Dhcp Failover Packets Dump

[sthaug at nethelp.no]

> <Resending the mail, as there is no response>

Why don't you setup a lab environment with two servers in a failover
configuration. Then you can sniff the traffic to your heart's content.

The traffic isn't particularly exciting. It's all TCP traffic, so you
need something which can reassemble and look "inside" the TCP sessions.
Here is an example of what it looks like using tcpdump:

07:08:04.697868 IP a.b.c.d.54148 > e.f.g.h.519: P 1:162(161) ack 178 win 8326 <nop,nop,timestamp 737998731 2252315951>
07:08:04.714148 IP e.f.g.h.519 > a.b.c.d.54148: P 178:218(40) ack 162 win 1040 <nop,nop,timestamp 2252315968 737998731>
07:08:04.714991 IP a.b.c.d.54148 > e.f.g.h.519: P 162:182(20) ack 218 win 8326 <nop,nop,timestamp 737998749 2252315968>
07:08:04.815593 IP e.f.g.h.519 > a.b.c.d.54148: . ack 182 win 1040 <nop,nop,timestamp 2252316070 737998749>

Steinar Haug, Nethelp consulting, sthaug at nethelp.no