Get mac address based on ip in filter wireshark

Ping packets should use an ICMP type of 8 (echo) or 0 (echo reply), so you could use a capture filter of:

icmp

and a display filter of:

icmp.type == 8 || icmp.type == 0

For HTTP, you can use a capture filter of:

tcp port 80

or a display filter of:

tcp.port == 80

or:

http

Note that a filter of http is not equivalent to the other two, which will include handshake and termination packets.

If you want to measure the number of connections rather than the amount of data, you can limit the capture or display filters to one side of the communication. For example, to capture only packets sent to port 80, use:

dst tcp port 80 

Couple that with an http display filter, or use:

tcp.dstport == 80 && http

For more on capture filters, read "Filtering while capturing" from the Wireshark user guide, the capture filters page on the Wireshark wiki, or pcap-filter (7) man page. For display filters, try the display filters page on the Wireshark wiki. The "Filter Expression" dialog box can help you build display filters.

According to your Wireshark capture the client requests an address multiple times via DHCP, but apparently does not process the response. If you have a firewall solution installed and enabled, please disable it for testing - it is well possible that it is interfering with the DHCP address assignment process.

What address does the client get in the end? If it is 192.168.0.5, the client was holding this address long before the DHCP process completed - it simply keeps the old address as the original DHCP request times out.

Furthermore, a DHCP DISCOVER packet is missing in the capture - when experimenting with DHCP leases please do a "full cycle" by issuing a

ipconfig /release

followed by

ipconfig /renew