@itachi_19 There is something going on here because both conditions can’t happen tcpdump sees nothing but dhcpd responds to a client request.
Are you running tcpdump as root or sudoing to it? If you don’t have elevated rights I can understand why tcpdump would not see (because tcpdump can’t connect to the raw socket).
Yes, both are VMs on a Virtualbox, and their network is set to NAT.
Well that would keep the witness computer from seeing this communication. With NAT enabled that still doesn’t explain where the tftp://10.0.2.4/Windows@2010.pxe “Windows 10.pxe” file name is coming from. As they say, the culprit has to be in the house (virtualbox).