To capture DHCP requests we need capture traffic on 67, 68, 69 ports. # tcpdump -n -i any port 67 or port 68 or port 69