tcp dump

[mkoopmans]

Hi there,

I need to make a brief description of the (g)pxe protocol.

I created a tcp dump and load it into wireshark.
In this dump I can see the client request reading the bootimage
undionly.kpxe from the server

12 11.057593 192.168.0.196 192.168.0.1 TFTP Read Request,
File: undionly.kpxe\000, Transfer type: octet\000, blksize\000=1456\000

But no where in the dump I find anything about the server telling the
client the filename is undionly.kpxe

So how does the clients knows he needs the file undionly.kpxe. I know
it's in the dhcp.conf file but that name is not transported to client in
the dhcp packets


regards,

Martin
--
M.B. Koopmans

Regiopolitie Hollands-Midden
Forensische Opsporing
Digitale Expertise

T: 071-5459327
F: 071-5459844
M: 06-46157206 (990997)
E: ***@phm.nl
E: ***@hollands-midden.politie.nl (no attachements)
PGP public key:
http://pgp.surfnet.nl:11371/pks/lookup?op=vindex&search=0x9A9678FE775A0AE2

[Miller, Shao]

Good day Martin,

You had a question in regards to gPXE. Are you aware that there is a
gPXE mailing-list?

http://www.etherboot.org/wiki/mailinglists
http://etherboot.org/mailman/listinfo/gpxe

You asked about how the DHCP service informs the PXE client that it
should download the file "undionly.kpxe". The DHCP service informs the
client of this in the boot filename option (option 67).

I believe that you are not performing a full tcpdump capture. By
default, tcpdump only captures 68 bytes from each packet. Your DHCP
transactions might therefore be truncated.

tcpdump -s 0

- Shao Miller