11

I'm trying to set up tcpdump to filter only gratuitous ARP's. I know that I need to search for packets with a host set to ff:ff:ff:ff:ff:ff. And I found the arp.opcode parameter, but I can't seem to get it to work. For example, this:

tcpdump -i wm0 arp and arp.opcode == 2

returns a syntax error.

Can anyone shed some light on this?

Thanks,

Jason M.

Improve this question
1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Commented Jan 5, 2021 at 22:54

1 Answer 1

Reset to default
14

In the usual tcpdump for Unix systems, only some fields are known by their name.

Try specifying the opcode field by offset and size, and comparing with 2 ("reply")

tcpdump -i eth99 arp and arp[6:2] == 2

For broadcasts with opcode "reply", which should be just the gratuitous ARPs:

tcpdump -i eth99 broadcast and arp and arp[6:2] == 2
Improve this answer
2
  • Thanks! I was hoping that their were things like tcpflags, but there aren't. You're answer is very close though.
    – Jason Mitchell
    Commented Jun 27, 2019 at 18:32
  • 3
    For anyone curious about the array syntax, arp[6:2] means 6th byte offset - capture 2 bytes - so offset 6 + offset 7.
    – Saad Malik
    Commented Sep 18, 2020 at 13:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.