Thanks for the instruction.
Below are the packets the router captured. Seems it sends out the IP address of 192.168.1.100?
root@router:~# tcpdump -i any -evn udp port 67
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes
11:23:49.005691 B [[my phone mac address]] ethertype IPv4 (0x0800), length 330: (tos 0x10, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 314)
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from [[my phone mac address]], length 286, xid 0xd8e6b909, Flags [none]
Client-Ethernet-Address [[my phone mac address]]
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Discover
Client-ID Option 61, length 7: ether [[my phone mac address]]
MSZ Option 57, length 2: 1500
Vendor-Class Option 60, length 15: "android-dhcp-10"
Parameter-Request Option 55, length 10:
Subnet-Mask, Default-Gateway, Domain-Name-Server, Domain-Name
MTU, BR, Lease-Time, RN
RB, Vendor-Option
11:23:49.005774 Out [[my phone mac address]] ethertype IPv4 (0x0800), length 330: (tos 0x10, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 314)
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from [[my phone mac address]], length 286, xid 0xd8e6b909, Flags [none]
Client-Ethernet-Address [[my phone mac address]]
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Discover
Client-ID Option 61, length 7: ether [[my phone mac address]]
MSZ Option 57, length 2: 1500
Vendor-Class Option 60, length 15: "android-dhcp-10"
Parameter-Request Option 55, length 10:
Subnet-Mask, Default-Gateway, Domain-Name-Server, Domain-Name
MTU, BR, Lease-Time, RN
RB, Vendor-Option
11:23:49.005824 Out [[my phone mac address]] ethertype IPv4 (0x0800), length 330: (tos 0x10, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 314)
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from [[my phone mac address]], length 286, xid 0xd8e6b909, Flags [none]
Client-Ethernet-Address [[my phone mac address]]
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Discover
Client-ID Option 61, length 7: ether [[my phone mac address]]
MSZ Option 57, length 2: 1500
Vendor-Class Option 60, length 15: "android-dhcp-10"
Parameter-Request Option 55, length 10:
Subnet-Mask, Default-Gateway, Domain-Name-Server, Domain-Name
MTU, BR, Lease-Time, RN
RB, Vendor-Option
11:23:49.005854 Out [[my phone mac address]] ethertype IPv4 (0x0800), length 330: (tos 0x10, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 314)
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from [[my phone mac address]], length 286, xid 0xd8e6b909, Flags [none]
Client-Ethernet-Address [[my phone mac address]]
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Discover
Client-ID Option 61, length 7: ether [[my phone mac address]]
MSZ Option 57, length 2: 1500
Vendor-Class Option 60, length 15: "android-dhcp-10"
Parameter-Request Option 55, length 10:
Subnet-Mask, Default-Gateway, Domain-Name-Server, Domain-Name
MTU, BR, Lease-Time, RN
RB, Vendor-Option
11:23:49.005691 B [[my phone mac address]] ethertype IPv4 (0x0800), length 330: (tos 0x10, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 314)
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from [[my phone mac address]], length 286, xid 0xd8e6b909, Flags [none]
Client-Ethernet-Address [[my phone mac address]]
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Discover
Client-ID Option 61, length 7: ether [[my phone mac address]]
MSZ Option 57, length 2: 1500
Vendor-Class Option 60, length 15: "android-dhcp-10"
Parameter-Request Option 55, length 10:
Subnet-Mask, Default-Gateway, Domain-Name-Server, Domain-Name
MTU, BR, Lease-Time, RN
RB, Vendor-Option
11:23:49.007943 Out [[router mac address]] ethertype IPv4 (0x0800), length 344: (tos 0xc0, ttl 64, id 43060, offset 0, flags [none], proto UDP (17), length 328)
192.168.1.1.67 > 192.168.1.100.68: BOOTP/DHCP, Reply, length 300, xid 0xd8e6b909, Flags [none]
Your-IP 192.168.1.100
Server-IP 192.168.1.1
Client-Ethernet-Address [[my phone mac address]]
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Offer
Server-ID Option 54, length 4: 192.168.1.1
Lease-Time Option 51, length 4: 604800
RN Option 58, length 4: 302400
RB Option 59, length 4: 529200
Subnet-Mask Option 1, length 4: 255.255.255.0
BR Option 28, length 4: 192.168.1.255
Default-Gateway Option 3, length 4: 192.168.1.1
Domain-Name-Server Option 6, length 4: 192.168.1.1
Domain-Name Option 15, length 3: "lan"
11:23:49.008001 Out [[router mac address]] ethertype IPv4 (0x0800), length 344: (tos 0xc0, ttl 64, id 43060, offset 0, flags [none], proto UDP (17), length 328)
192.168.1.1.67 > 192.168.1.100.68: BOOTP/DHCP, Reply, length 300, xid 0xd8e6b909, Flags [none]
Your-IP 192.168.1.100
Server-IP 192.168.1.1
Client-Ethernet-Address [[my phone mac address]]
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Offer
Server-ID Option 54, length 4: 192.168.1.1
Lease-Time Option 51, length 4: 604800
RN Option 58, length 4: 302400
RB Option 59, length 4: 529200
Subnet-Mask Option 1, length 4: 255.255.255.0
BR Option 28, length 4: 192.168.1.255
Default-Gateway Option 3, length 4: 192.168.1.1
Domain-Name-Server Option 6, length 4: 192.168.1.1
Domain-Name Option 15, length 3: "lan"
11:23:50.995710 B [[my phone mac address]] ethertype IPv4 (0x0800), length 330: (tos 0x10, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 314)
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from [[my phone mac address]], length 286, xid 0xd8e6b909, secs 1, Flags [none]
Client-Ethernet-Address [[my phone mac address]]
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Discover
Client-ID Option 61, length 7: ether [[my phone mac address]]
MSZ Option 57, length 2: 1500
Vendor-Class Option 60, length 15: "android-dhcp-10"
Parameter-Request Option 55, length 10:
Subnet-Mask, Default-Gateway, Domain-Name-Server, Domain-Name
MTU, BR, Lease-Time, RN
RB, Vendor-Option
11:23:50.995832 Out [[my phone mac address]] ethertype IPv4 (0x0800), length 330: (tos 0x10, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 314)
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from [[my phone mac address]], length 286, xid 0xd8e6b909, secs 1, Flags [none]
Client-Ethernet-Address [[my phone mac address]]
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Discover
Client-ID Option 61, length 7: ether [[my phone mac address]]
MSZ Option 57, length 2: 1500
Vendor-Class Option 60, length 15: "android-dhcp-10"
Parameter-Request Option 55, length 10:
Subnet-Mask, Default-Gateway, Domain-Name-Server, Domain-Name
MTU, BR, Lease-Time, RN
RB, Vendor-Option
11:23:50.995888 Out [[my phone mac address]] ethertype IPv4 (0x0800), length 330: (tos 0x10, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 314)
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from [[my phone mac address]], length 286, xid 0xd8e6b909, secs 1, Flags [none]
Client-Ethernet-Address [[my phone mac address]]
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Discover
Client-ID Option 61, length 7: ether [[my phone mac address]]
MSZ Option 57, length 2: 1500
Vendor-Class Option 60, length 15: "android-dhcp-10"
Parameter-Request Option 55, length 10:
Subnet-Mask, Default-Gateway, Domain-Name-Server, Domain-Name
MTU, BR, Lease-Time, RN
RB, Vendor-Option
11:23:50.995923 Out [[my phone mac address]] ethertype IPv4 (0x0800), length 330: (tos 0x10, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 314)
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from [[my phone mac address]], length 286, xid 0xd8e6b909, secs 1, Flags [none]
Client-Ethernet-Address [[my phone mac address]]
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Discover
Client-ID Option 61, length 7: ether [[my phone mac address]]
MSZ Option 57, length 2: 1500
Vendor-Class Option 60, length 15: "android-dhcp-10"
Parameter-Request Option 55, length 10:
Subnet-Mask, Default-Gateway, Domain-Name-Server, Domain-Name
MTU, BR, Lease-Time, RN
RB, Vendor-Option
11:23:50.995710 B [[my phone mac address]] ethertype IPv4 (0x0800), length 330: (tos 0x10, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 314)
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from [[my phone mac address]], length 286, xid 0xd8e6b909, secs 1, Flags [none]
Client-Ethernet-Address [[my phone mac address]]
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Discover
Client-ID Option 61, length 7: ether [[my phone mac address]]
MSZ Option 57, length 2: 1500
Vendor-Class Option 60, length 15: "android-dhcp-10"
Parameter-Request Option 55, length 10:
Subnet-Mask, Default-Gateway, Domain-Name-Server, Domain-Name
MTU, BR, Lease-Time, RN
RB, Vendor-Option
11:23:50.998046 Out [[router mac address]] ethertype IPv4 (0x0800), length 344: (tos 0xc0, ttl 64, id 43297, offset 0, flags [none], proto UDP (17), length 328)
192.168.1.1.67 > 192.168.1.100.68: BOOTP/DHCP, Reply, length 300, xid 0xd8e6b909, secs 1, Flags [none]
Your-IP 192.168.1.100
Server-IP 192.168.1.1
Client-Ethernet-Address [[my phone mac address]]
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Offer
Server-ID Option 54, length 4: 192.168.1.1
Lease-Time Option 51, length 4: 604800
RN Option 58, length 4: 302400
RB Option 59, length 4: 529200
Subnet-Mask Option 1, length 4: 255.255.255.0
BR Option 28, length 4: 192.168.1.255
Default-Gateway Option 3, length 4: 192.168.1.1
Domain-Name-Server Option 6, length 4: 192.168.1.1
Domain-Name Option 15, length 3: "lan"
11:23:50.998101 Out [[router mac address]] ethertype IPv4 (0x0800), length 344: (tos 0xc0, ttl 64, id 43297, offset 0, flags [none], proto UDP (17), length 328)
192.168.1.1.67 > 192.168.1.100.68: BOOTP/DHCP, Reply, length 300, xid 0xd8e6b909, secs 1, Flags [none]
Your-IP 192.168.1.100
Server-IP 192.168.1.1
Client-Ethernet-Address [[my phone mac address]]
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Offer
Server-ID Option 54, length 4: 192.168.1.1
Lease-Time Option 51, length 4: 604800
RN Option 58, length 4: 302400
RB Option 59, length 4: 529200
Subnet-Mask Option 1, length 4: 255.255.255.0
BR Option 28, length 4: 192.168.1.255
Default-Gateway Option 3, length 4: 192.168.1.1
Domain-Name-Server Option 6, length 4: 192.168.1.1
Domain-Name Option 15, length 3: "lan"
11:23:55.281600 B [[my phone mac address]] ethertype IPv4 (0x0800), length 330: (tos 0x10, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 314)
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from [[my phone mac address]], length 286, xid 0xd8e6b909, secs 6, Flags [none]
Client-Ethernet-Address [[my phone mac address]]
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Discover
Client-ID Option 61, length 7: ether [[my phone mac address]]
MSZ Option 57, length 2: 1500
Vendor-Class Option 60, length 15: "android-dhcp-10"
Parameter-Request Option 55, length 10:
Subnet-Mask, Default-Gateway, Domain-Name-Server, Domain-Name
MTU, BR, Lease-Time, RN
RB, Vendor-Option
11:23:55.281694 Out [[my phone mac address]] ethertype IPv4 (0x0800), length 330: (tos 0x10, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 314)
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from [[my phone mac address]], length 286, xid 0xd8e6b909, secs 6, Flags [none]
Client-Ethernet-Address [[my phone mac address]]
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Discover
Client-ID Option 61, length 7: ether [[my phone mac address]]
MSZ Option 57, length 2: 1500
Vendor-Class Option 60, length 15: "android-dhcp-10"
Parameter-Request Option 55, length 10:
Subnet-Mask, Default-Gateway, Domain-Name-Server, Domain-Name
MTU, BR, Lease-Time, RN
RB, Vendor-Option
11:23:55.281751 Out [[my phone mac address]] ethertype IPv4 (0x0800), length 330: (tos 0x10, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 314)
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from [[my phone mac address]], length 286, xid 0xd8e6b909, secs 6, Flags [none]
Client-Ethernet-Address [[my phone mac address]]
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Discover
Client-ID Option 61, length 7: ether [[my phone mac address]]
MSZ Option 57, length 2: 1500
Vendor-Class Option 60, length 15: "android-dhcp-10"
Parameter-Request Option 55, length 10:
Subnet-Mask, Default-Gateway, Domain-Name-Server, Domain-Name
MTU, BR, Lease-Time, RN
RB, Vendor-Option
11:23:55.281785 Out [[my phone mac address]] ethertype IPv4 (0x0800), length 330: (tos 0x10, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 314)
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from [[my phone mac address]], length 286, xid 0xd8e6b909, secs 6, Flags [none]
Client-Ethernet-Address [[my phone mac address]]
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Discover
Client-ID Option 61, length 7: ether [[my phone mac address]]
MSZ Option 57, length 2: 1500
Vendor-Class Option 60, length 15: "android-dhcp-10"
Parameter-Request Option 55, length 10:
Subnet-Mask, Default-Gateway, Domain-Name-Server, Domain-Name
MTU, BR, Lease-Time, RN
RB, Vendor-Option
11:23:55.281600 B [[my phone mac address]] ethertype IPv4 (0x0800), length 330: (tos 0x10, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 314)
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from [[my phone mac address]], length 286, xid 0xd8e6b909, secs 6, Flags [none]
Client-Ethernet-Address [[my phone mac address]]
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Discover
Client-ID Option 61, length 7: ether [[my phone mac address]]
MSZ Option 57, length 2: 1500
Vendor-Class Option 60, length 15: "android-dhcp-10"
Parameter-Request Option 55, length 10:
Subnet-Mask, Default-Gateway, Domain-Name-Server, Domain-Name
MTU, BR, Lease-Time, RN
RB, Vendor-Option
11:23:55.283669 Out [[router mac address]] ethertype IPv4 (0x0800), length 344: (tos 0xc0, ttl 64, id 43910, offset 0, flags [none], proto UDP (17), length 328)
192.168.1.1.67 > 192.168.1.100.68: BOOTP/DHCP, Reply, length 300, xid 0xd8e6b909, secs 6, Flags [none]
Your-IP 192.168.1.100
Server-IP 192.168.1.1
Client-Ethernet-Address [[my phone mac address]]
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Offer
Server-ID Option 54, length 4: 192.168.1.1
Lease-Time Option 51, length 4: 604800
RN Option 58, length 4: 302400
RB Option 59, length 4: 529200
Subnet-Mask Option 1, length 4: 255.255.255.0
BR Option 28, length 4: 192.168.1.255
Default-Gateway Option 3, length 4: 192.168.1.1
Domain-Name-Server Option 6, length 4: 192.168.1.1
Domain-Name Option 15, length 3: "lan"
11:23:55.283720 Out [[router mac address]] ethertype IPv4 (0x0800), length 344: (tos 0xc0, ttl 64, id 43910, offset 0, flags [none], proto UDP (17), length 328)
192.168.1.1.67 > 192.168.1.100.68: BOOTP/DHCP, Reply, length 300, xid 0xd8e6b909, secs 6, Flags [none]
Your-IP 192.168.1.100
Server-IP 192.168.1.1
Client-Ethernet-Address [[my phone mac address]]
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Offer
Server-ID Option 54, length 4: 192.168.1.1
Lease-Time Option 51, length 4: 604800
RN Option 58, length 4: 302400
RB Option 59, length 4: 529200
Subnet-Mask Option 1, length 4: 255.255.255.0
BR Option 28, length 4: 192.168.1.255
Default-Gateway Option 3, length 4: 192.168.1.1
Domain-Name-Server Option 6, length 4: 192.168.1.1
Domain-Name Option 15, length 3: "lan"