Originally Posted By: mlord
But I have no idea if it is *always* at that exact offset, or whether more intelligent parsing of the packet is necessary to ensure it works everywhere (?).

According to RFCs 951 & 2131, the offset is constant, so no worries.

But just in case someone wants to run a DHCP *server* on the empeg, it might be slightly safer to also check the bootp message type field as well.. as is now done in Hijack v502.

Cheers


Edited by mlord (10/08/2008 11:17)