====== tcpdump goodies ====== ===== Capture only PXE traffic (tftp and dhcp requests) ===== sudo tcpdump -i eth0 -s 1600 -neeevvvX "proto (\udp or \tcp) and port (67 or 68 or 69)" The same but with a more simple output: sudo tcpdump -i eth0 -s 1600 -n "proto (\udp or \tcp) and port (67 or 68 or 69)"