I'm trying to set up tcpdump to filter only gratuitous ARP's. I know that I need to search for packets with a host set to ff:ff:ff:ff:ff:ff. And I found the arp.opcode parameter, but I can't seem to get it to work. For example, this:
tcpdump -i wm0 arp and arp.opcode == 2
returns a syntax error.
Can anyone shed some light on this?