From e73041f34bc0a18b42fa958febc1beb655cc61a2 Mon Sep 17 00:00:00 2001
From: nnposter <nnposter@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Sun, 24 Apr 2022 01:22:54 +0000
Subject: [PATCH] Optimize BPF to capture only DHCP responses

---
 scripts/broadcast-dhcp-discover.nse | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/broadcast-dhcp-discover.nse b/scripts/broadcast-dhcp-discover.nse
index 2c1203cf6..e02ca028d 100644
--- a/scripts/broadcast-dhcp-discover.nse
+++ b/scripts/broadcast-dhcp-discover.nse
@@ -236,7 +236,7 @@ action = function()
 
     local sock, co
     sock = nmap.new_socket()
-    sock:pcap_open(iface, 1500, false, "ip && udp && port 68")
+    sock:pcap_open(iface, 1500, false, "ip && udp dst port 68")
     co = stdnse.new_thread( dhcp_listener, sock, iface, macaddr, timeout, xid, result )
     threads[co] = true
   end