Using a Wireshark network trace to troubleshoot PXE boot process issues
Article ID: 181525
Updated On:
Products
Issue/Introduction
How do you use a network trace (i.e. Wireshark trace) to troubleshoot PXE server issues?
Resolution
1. The following screen shows the normal, successful PXE boot process of a client machine connecting to a DHCP server and a PXE server:
Diagnosis: Successful PXE boot process
Line 1: Initial Discover packet from client.
Line 2: Initial Offer packet from DHCP server.
Line 3: PXE server Offer packet from PXE server 10.10.10.3.
Line 4: Client Request packet to DHCP server requesting the use of offered IP address.
Line 5: Acknowledgment packet from DHCP server to client verifying IP address.
2. The following screen shows a situation where the PXE boot process sometimes works but often fails:
Diagnosis:
Line 47: Initial Discover packet from client.
Line 48: Initial Offer packet from DHCP server.
Line 49: PXE server Offer packet from PXE server 10.103.6.25
Line 50: PXE server Offer packet from PXE server 10.103.64.248
Line 53: Client Request packet to DHCP server requesting the use of offered IP address
Line 54: Acknowledgment packet from DHCP server to client verifying IP address
Line 94: Client request to first PXE server asking for PXE menu.
Line 95: Acknowledgment from first PXE server with PXE menu
Cause:
Multiple PXE servers on same network segment. A client will respond only to the first PXE server offered.
3. During the PXE boot process, the client machine shows the following - Error = PXE-E53 “No boot filename received”:
Diagnosis:
Line 47: Initial Discover packet from client.
Line 48: Initial Offer packet from DHCP server.
Line 53: Client Request packet to DHCP server requesting the use of offered IP address
Line 54: Acknowledgment packet from DHCP server to client verifying IP address
Cause:
After making DHCP request, no PXE server reports to client.
Resolution:
- Firewall on PXE server blocking traffic.
- The Altiris PXE Server service is not running
- Network communications to or from PXE server is being blocked by routers or layer 3 switches.
- DHCP server option 60 not set correctly.
- PXE communications ports 67 or 68 is being used by another program or service.
- PXE MAC Filtering is enabled.
- Corrupt PXE server.
4. During the PXE boot process, the client machine shows the following - Error = PXE-E51 “No DHCP or proxyDHCP offers were received”:
Diagnosis:
Line 11: Initial Discover packet from client looking for DHCP server.
Line 12: PXE server Offer packet from PXE server 10.103.64.25.
Line 16: Repeat of initial Discover packet from client still looking for DHCP server.
Line 17: Repeat of PXE server Offer packet from PXE server 10.103.64.25.
Line 23: Repeat of initial Discover packet from client still looking for DHCP server.
Line 24: Repeat of PXE server Offer packet from PXE server 10.103.64.25.
Line 35: Repeat of initial Discover packet from client still looking for DHCP server.
Line 36: Repeat of PXE server Offer packet from PXE server 10.103.64.25.
Cause:
After making DHCP request, no DHCP server responds to client.
Resolution:
- The DHCP server is down or is not reachable because of faulty routers or hubs.
- Routers or layer 3 switches are misconfigured and blocking network traffic. Managed switches may need to have “Portfast” enabled or may be running “spanning-tree”.
5. During the PXE boot process, the client machine shows the following - Error = PXE-E52 “ProxyDHCP offers were received. No DHCP offers were received”:
Diagnosis:
Line 11: Initial Discover packet from client looking for DHCP server.
Line 12: PXE server Offer packet from PXE server 10.103.64.25.
Line 16: Repeat of initial Discover packet from client still looking for DHCP server.
Line 17: Repeat of PXE server Offer packet from PXE server 10.103.64.25.
Line 23: Repeat of initial Discover packet from client still looking for DHCP server.
Line 24: Repeat of PXE server Offer packet from PXE server 10.103.64.25.
Line 35: Repeat of initial Discover packet from client still looking for DHCP server.
Line 36: Repeat of PXE server Offer packet from PXE server 10.103.64.25.
Cause:
After making DHCP request, no DHCP server responds to client. If Wireshark is run on the DHCP server, the incoming Discover packets do show up but no Offer from DHCP server is returned.
Resolution:
The DHCP server has been configured incorrectly. The DHCP scopes does not include information allowing the servicing of the subnet or zone that the workstation is in.
Feedback
