From Syslinux Wiki
Revision as of 16:22, 10 July 2015 by Ady (talk | contribs) (Wiki formatting.)

Jump to: navigation, search
Please note, this page is under development at the moment and may be incomplete or possibly use incorrect terminology.


When users encounter issues, there are a number of steps that can be taken to collect information surrounding the issue. Steps here should contain no compiling.

First Steps

Check over Hardware Compatibility, Common Problems and the latest NEWS file to see if your issue might be known/resolved/have a workaround.



Using a port mirror in an intelligent switch is the most effective way of capturing the traffic to/from a PXE client. Cisco Catalyst switches running IOS use "port monitor" and/or "monitor session". Cisco Catalyst switches running CatOS (CatalystOS) use "span" (short for "Switch Port ANalyzer"). Some HP switches use "traffic mirroring" and "traffic monitoring".

  • Cisco IOS example:
 monitor session 1 source interface GigabitEthernet0/2
 monitor session 1 destination interface GigabitEthernet0/1
  • HP ProVision ASIC example (last line stops the monitor):
 mirror 4 port 1
 interface 2
 monitor all both mirror 4
 no monitor all both mirror 4

Once a mirror of the PXE client's port is configured, the capture interface on the machine doing the capture should be as silent as possible to prevent unwanted packets from being captured.


For a PXE client that can successfully use DHCP to identify the characteristics it should use (including the server and filename to boot), capturing traffic from the machine running the tftpd is pretty effective. Most tftpds will move to another port for the actual data transmission but the PXE client's IP should be in all of the applicable traffic. Filtering to just packets with that IP will likely suffice.

Using wireshark with a capture filter of 'host' (assuming is the PXE client) will generally capture all relevant packets and no irrelevant packets.

  • An example tcpdump command:
`tcpdump -i eth0 -s 0 -w dump.cap 'host'`
  • Other sample filters include:
<host-specifier> or ( (udp port 67 or udp port 68) and (udp[36:4] = 0x<MAC-0-3>) and (udp[40:2] = 0x<MAC-4-5>) )
"host specifier" could be an IP address as above, or a MAC address like 'ether host 12:34:56:78:9a:bc'.
"MAC-0-3" is the first-through-fourth byte of the MAC and "MAC-4-5" is the fifth and sixth. In the example:
    'ether host 12:34:56:78:9a:bc or ( (udp port 67 or udp port 68) and (udp[36:4] = 0x12345678) and (udp[40:2] = 0x9abc) )'


If a PXE client has difficulty retrieving pxelinux.0, or PXELINUX has difficulty retrieving a file on the same or another server, a simple test is to attempt to retrieve the same file from a full-blown client. Sometimes testing from a client on another subnet is sufficient to see the issue, but sometimes it is necessary to test from the same subnet as the PXE client, or the same IP as the PXE client (with the PXE client off), in case there are any ACLs on devices between the PXE client and the TFTP system, or ACLs on the TFTP system.