I am very confused here and don't know what to make of it. Wireshark's most powerful feature is its vast array of display filters (over 285000 fields in 3000 protocols as of version They let you drill down to the exact traffic you want to see and are the basis of many of Wireshark's other features, such as the coloring rules. in order words, the DHCP server and host requesting for IP address have their IP addresses but both share the same MAC address which is the original MAC address of the client sending the DHCP request But other DHCP requests from other hosts in the network to the DHCP server has correct MAC address of the DHCP server and there are getting response from the DHCP server. For example, while filtering for Dynamic Host Configuration Protocol (DHCP). The DHCP server had its IP address and MAC address from the beginning of the package none of which was shared by another device on the network but in this interaction, a host sent about 5 un-replied DHCP requests to the DHCP server and what I noticed is that while the DHCP server's IP address is what has always been, the MAC address is now the same with that of the client sending the DHCP request. While building either a capture or a display filter, Wireshark will check.

I am going through a network capture file and I saw a DHCP interaction that I really don't understand and need someone to help explain it to me.

Wireshark dhcp filter