wireshark display filter unterschied cature filter

Looked at the packet, and it showed me the layer-2 (MAC) address of the 'DHCP Server, 169.254.1.1'. Wireshark showed that he received a DHCP-assigned ip from a device '169.254.1.1', and the IP assigned was '169.254.1.113'. We had Wireshark running on a guy's laptop, and he suffered the problem luckily.

I'd like the person at the Windows machine to determine when their own lease expires. but that's a different group, and a separate phonecall etc etc. Yes, I can get this from the DHCP server-side.

Secondly: Does anyone know how to get Windows to spit out the Time Remaining in the DHCP lease? The interwebs all say 'ipconfig /all' shows you the lease time - but yeah. I need Wireshark to tell me what's happening during that negotiation at the end of the Lease time. Then, a helpdesk person comes around, and does an ipconfig /release and renew, and they get a valid IP, and they're back in business. A client will occasionally assign itself a .x address. The problem occurs when the Windows DHCP Lease Time expires, and an negotiation happens with the DHCP server. Cramer, that Capture Filter worked! -I thought I tried it earlier, and the field was still Pink.

Wireshark display filter unterschied cature filter