Technical Tip: View DHCP Fingerprint information received by from hosts

[FortiKoala]

Description

This article describes how to view DHCP traffic received from the production network for DHCP fingerprint data.

Scope

Version: FortiNAC 9.x & FortiNAC-F 7.x.

Solution

Option 1: Administration UI.

1. Navigate to Users & Hosts -> Endpoint Fingerprints.
2. To filter just DHCP traffic, select the filter icon next to the Source column header.

Click on the image below to zoom in.

Option 2: FortiNAC CLI - Run a tcpdump and filter for port 67 or 68.

CentOS: 

1. Login as root and run the following command:

tcpdump -nni eth0 port 67 or 68

2. Press CTRL+C to stop the process.

FortiNAC-OS:

See Technical Tip: Run tcpdump in FNAC-F and save capture as a file.