Best would be to hook the client to a hub and capture traffic from there.
Second best if you can capture TFTP-DHCP and FOG-server at the same time. I should be able to “synchronize” those two dump files by looking at the broadcast packets.
And as a quick try you might just capture on the TFTP-DHCP server. Hopefully I am able to make the missing packets up myself.
Useful tcpdump options:
-i eth0 capture interface, change to suit your needs -w outfile.pcap write packets to PCAP file (you won’t see the packets while capturing!) As last parameter you can add capture filters but this is quite tricky when it comes to PXE boot and DHCP (several different protocols and ports). You can simply use udp as a filter or not port 22 to keep your SSH session out of the way. Sometimes host x.x.x.x is also great but not in this case here.