# tcpdump -r /root/eth1.log
reading from file /root/eth1.log, link-type EN10MB (Ethernet)
16:14:46.890114 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:12:79:d3:39:4d (oui Unknown), length 548
16:14:46.893964 arp who-has 172.31.20.253 tell 172.31.20.1
16:14:47.002020 IP 172.31.20.1.bootps > 255.255.255.255.bootpc: BOOTP/DHCP, Reply, length 300
16:14:47.894042 arp who-has 172.31.20.253 tell 172.31.20.1
16:14:48.894121 arp who-has 172.31.20.253 tell 172.31.20.1
16:14:50.954733 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:12:79:d3:39:4d (oui Unknown), length 548
16:14:50.979870 IP 172.31.20.1.bootps > 255.255.255.255.bootpc: BOOTP/DHCP, Reply, length 300
16:14:50.980401 arp who-has 172.31.20.1 tell 172.31.20.253
16:14:50.980422 arp reply 172.31.20.1 is-at 00:12:79:94:f4:65 (oui Unknown)
16:14:50.980505 IP 172.31.20.253.2070 > 172.31.20.1.tftp:  27 RRQ "pxelinux.0" octet tsize 0
16:14:50.981422 IP 172.31.20.1.34313 > 172.31.20.253.2070: UDP, length 14
16:14:50.981514 IP 172.31.20.253.2070 > 172.31.20.1.34313: UDP, length 17
16:14:50.981686 IP 172.31.20.253.2071 > 172.31.20.1.tftp:  32 RRQ "pxelinux.0" octet blksize 1456
16:14:50.982465 IP 172.31.20.1.34313 > 172.31.20.253.2071: UDP, length 15
16:14:50.982555 IP 172.31.20.253.2071 > 172.31.20.1.34313: UDP, length 4
16:14:50.982618 IP 172.31.20.1.34313 > 172.31.20.253.2071: UDP, length 1460
16:14:50.982741 IP 172.31.20.253.2071 > 172.31.20.1.34313: UDP, length 4
16:14:50.982759 IP 172.31.20.1.34313 > 172.31.20.253.2071: UDP, length 1460
16:14:50.983038 IP 172.31.20.253.2071 > 172.31.20.1.34313: UDP, length 4
16:14:50.983055 IP 172.31.20.1.34313 > 172.31.20.253.2071: UDP, length 1460
16:14:50.983339 IP 172.31.20.253.2071 > 172.31.20.1.34313: UDP, length 4
16:14:50.983356 IP 172.31.20.1.34313 > 172.31.20.253.2071: UDP, length 1460
16:14:50.983655 IP 172.31.20.253.2071 > 172.31.20.1.34313: UDP, length 4
16:14:50.983672 IP 172.31.20.1.34313 > 172.31.20.253.2071: UDP, length 1460
16:14:50.983972 IP 172.31.20.253.2071 > 172.31.20.1.34313: UDP, length 4
16:14:50.983989 IP 172.31.20.1.34313 > 172.31.20.253.2071: UDP, length 1460
16:14:50.984285 IP 172.31.20.253.2071 > 172.31.20.1.34313: UDP, length 4
16:14:50.984302 IP 172.31.20.1.34313 > 172.31.20.253.2071: UDP, length 1460
16:14:50.984646 IP 172.31.20.253.2071 > 172.31.20.1.34313: UDP, length 4
16:14:50.984663 IP 172.31.20.1.34313 > 172.31.20.253.2071: UDP, length 1460
16:14:50.985007 IP 172.31.20.253.2071 > 172.31.20.1.34313: UDP, length 4
16:14:50.985024 IP 172.31.20.1.34313 > 172.31.20.253.2071: UDP, length 1460
16:14:50.985321 IP 172.31.20.253.2071 > 172.31.20.1.34313: UDP, length 4
16:14:50.985337 IP 172.31.20.1.34313 > 172.31.20.253.2071: UDP, length 380
16:14:50.985673 IP 172.31.20.253.2071 > 172.31.20.1.34313: UDP, length 4
16:14:51.038467 IP 172.31.20.253.57089 > 0.0.0.0.tftp:  63 RRQ "pxelinux.cfg/01-00-12-79-d3-39-4d" octet tsize 0 blks
16:14:51.697522 IP 172.31.20.253.57089 > 0.0.0.0.tftp:  63 RRQ "pxelinux.cfg/01-00-12-79-d3-39-4d" octet tsize 0 blks
16:14:53.016022 IP 172.31.20.253.57089 > 0.0.0.0.tftp:  63 RRQ "pxelinux.cfg/01-00-12-79-d3-39-4d" octet tsize 0 blks
16:14:55.652782 IP 172.31.20.253.57089 > 0.0.0.0.tftp:  63 RRQ "pxelinux.cfg/01-00-12-79-d3-39-4d" octet tsize 0 blks
16:14:55.978692 arp who-has 172.31.20.253 tell 172.31.20.1
16:14:55.978780 arp reply 172.31.20.253 is-at 00:12:79:d3:39:4d (oui Unknown)
16:15:00.926674 IP 172.31.20.253.57089 > 0.0.0.0.tftp:  63 RRQ "pxelinux.cfg/01-00-12-79-d3-39-4d" octet tsize 0 blks
16:15:11.474995 IP 172.31.20.253.57089 > 0.0.0.0.tftp:  63 RRQ "pxelinux.cfg/01-00-12-79-d3-39-4d" octet tsize 0 blks
16:15:32.571276 IP 172.31.20.253.57090 > 0.0.0.0.tftp:  51 RRQ "pxelinux.cfg/AC1F14FD" octet tsize 0 blksize 1440
tcpdump: pcap_loop: truncated dump file; tried to read 93 captured bytes, only got 33