Search code examples
pcaptcpdump

TCP dump filter for an ARP H\W address

What TCP dump filter should I use to get an ARP packet with a specific H\W address(src or dst) from a pcap dump file ?

Solution

  • Try this:

    "arp and ether host xx:xx:xx:xx:xx:xx"

    Refer to the PCAP-FILTER man page for more information.