This article explains how to configure the firewall filter to verify dhcp/bootp packets.

You need to monitor or validate DHCP/BOOTP traffic on an interface, particularly in scenarios where the device under test (DUT) acts as a DHCP relay.

Apply the following firewall filter configuration on the desired interface to inspect and count DHCP/BOOTP packets.

In the example below, the DUT functions as a DHCP relay. The filter captures typical DHCP/BOOTP communication from clients to servers and vice versa.

set firewall family inet filter FILTER-RE-IN term DHCP from protocol udp

set firewall family inet filter FILTER-RE-IN term DHCP from source-port bootps

set firewall family inet filter FILTER-RE-IN term DHCP from source-port bootpc

set firewall family inet filter FILTER-RE-IN term DHCP from source-port 1024-65535

set firewall family inet filter FILTER-RE-IN term DHCP from destination-port bootps

set firewall family inet filter FILTER-RE-IN term DHCP from destination-port bootpc

set firewall family inet filter FILTER-RE-IN term DHCP then count PERMIT-IPV4-DHCP

set firewall family inet filter FILTER-RE-IN term DHCP then accept

set firewall family inet filter FILTER-RE-IN term OTHER then accept

Additionally, you can add source and destination address for return traffic(from Server to client)

DHCP uses UDP ports 67 (bootps) and 68 (bootpc). The source-port 1024-65535 line covers ephemeral client-side ports commonly used in return traffic.