[Dnsmasq-discuss] RaspberryPi PCAP file Was: tftp hook for "not found"

[Geert Stappers]

On Thu, Dec 02, 2021 at 10:02:27PM +0000, Simon Kelley wrote:
In-Reply-To: <e6dfc893-f741-9b2f-eae2-bf8cc24ea9a6 at thekelleys.org.uk>
> On 02/12/2021 16:00, Carl Karsten wrote:
> 
> > for more details on what it does:
> > it first does many ftp get /<filenam> and it isn't clear what files it
> > needs from the boot partition.if t can't find the file in / then it
> > tries /<serial>/<filename>
> > so I could put all 41 files in /srv/tftp ... but that makes me grumpy.

The 'it' is time is a RaspberryPi, probably version 3.
Posting https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2021q4/015957.html
is vague about it. ( There is no clear "Version X is being used" )


> I've not played with Pi, but assuming it's some variety of the PXE
> protocol, that usually tries  pathnames constructed from the MAC
> address, then the IP address with decreasing specificity (Ie
> 192.168.1.100, then 192.168.1, then 192.168, then 192) and finally it
> tries a fixed pathname. If you don't want to have machine-specific boot
> files, just don't provide those files and the boot process will drop
> though top the generic ones.


What would help is providing a fairly complete  network packet capture
of a Raspi attempting to netboot.  'fairly' because it is OK if the
capture stops at the point of requesting /srv/tftp/7a6d27f6/autoboot.txt
'complete' for aiming to providing the "whole picture".

What follows is describing the "how". Probably too detailed and surely
untested. You are invited to translate the procedure to your setup.

* Have two computers, one being client, a Raspi.  The other being a
  server.
* On the server
  * Running dnsmasq
  * Being DHCP server
  * Being TFTP server
  * Having configuration that tells the client to come to this server
  * Having installed tcpdump
  * Known the name of the network interface connected to the client.
    Let's assume it is 'eth3'
* Invoke `sudo /sbin/tcpdump -ni eth3 port bootpc` on the server
* Netbook the Raspi
* At the server should tcpdump show Bootp requests or DHCP requests
* Stop tcpdump with Control-C so we can go the next step
* Invoke `sudo /sbin/tcpdump -ni eth3 ether host dc:a6:32:05:7f:03`
  where 'dc:a6:32:05:7f:03' is the MAC of the Raspi.
* Netbook the Raspi
* At the server should tcpdump show Bootp requests or DHCP requests
  of the Raspi we are testing. And only from that client.
* Stop tcpdump with Control-C so we can go the next step
* Invoke `sudo /sbin/tcpdump -ni eth3 -w raspiModelFoo.pcap ether host dc:a6:32:05:7f:03`
* Netbook the Raspi
* tcpdump wil not show anything
* Give the Raspi to (attempt to) netboot
* Stop tcpdump with Control-C so we can go the next step
* There is a libpcap file  'raspiModelFoo.pcap'  (ModelFoo replaced with
  your actual model of RaspberryPI
* Save the .pcap somewhere on the Internet where it can be fetched.
* Share the URL with the mailinglist. Karma bonus points for an URL
  that can be used with `wget`.


Groeten
Geert Stappers
-- 
Silence is hard to parse