The MAC itself was traced to a PoE adapter, where it dissapeared somewhere. It was an old, unsupported, (and malfunctioning) Cisco CX70 Teleconferencing center - the kind with the $30,000 side-by-side flatpannels. Easily traced it thru our Cisco switches with 'show mac address-table'. Looked at the packet, and it showed me the layer-2 (MAC) address of the 'DHCP Server, 169.254.1.1'. Wireshark showed that he received a DHCP-assigned ip from a device '169.254.1.1', and the IP assigned was '169.254.1.113'. We had Wireshark running on a guy's laptop, and he suffered the problem luckily. I'd like the person at the Windows machine to determine when their own lease expires. but that's a different group, and a separate phonecall etc etc. Yes, I can get this from the DHCP server-side. Secondly: Does anyone know how to get Windows to spit out the Time Remaining in the DHCP lease? The interwebs all say 'ipconfig /all' shows you the lease time - but yeah. I need Wireshark to tell me what's happening during that negotiation at the end of the Lease time. Then, a helpdesk person comes around, and does an ipconfig /release and renew, and they get a valid IP, and they're back in business. A client will occasionally assign itself a .x address.

The problem occurs when the Windows DHCP Lease Time expires, and an negotiation happens with the DHCP server. Cramer, that Capture Filter worked! -I thought I tried it earlier, and the field was still Pink.

Wireshark dhcp filter