As I understand it, for IPv4 I would need to capture
- UDP port 67 and 68,
- ICMP echo request and reply,
and for IPv6 I would need
- UDP port 546 and 547,
- all DHCP-related multicast addresses,
- ICMPv6 neighbor discovery.
I want to capture DHCP related traffic with tcpdump or wireshark for later analysis.
Although I want to make the filter as specific as possible to get a small capture file, I don't want to miss out on some important packets like those used to verify that an IP address is not yet taken.
Am I missing something?