How to monitor the ARP requests from other than eth1
Hi All
I am trying to monitor the arp requests for all the machines connected to my LAN through eth1. I am using the following tcpdump instruction: tcpdump 'arp' -e -i eth1 -n -p -t that instruction is working perfectly, but how can I exclude the arp requests of the eth1 itself. I want to receive the arp requests for all the machine in my LAN except for the eth1 which is fixed on the monitoring machine Thanks for help in advanced Regards Bassam |
You can try the following:
tcpdump not ether host <your MAC address> |grep arp |
Hi Shubb,
I tried the your instruction, but unfortunately it is monitoring the eth0 since my Linux box is a gateway and it contains 2 NIC, eth0 is connected to the Internet and eth1 is connected to my internal LAN. So that I want only to capture the ARP requests issued by all the machines connected to my LAN except for eth1. The instruction that u suggested monitores the eth0 on my Linux box. Thanks Bassam |
Ok, then add the "-i eth1" to switch interfaces.
|
Ok Guys, I solved the problem. The instruction should be:
tcpdump -c 1 -e not ether src host 00:50:BA:C3:81:3B and arp and not rarp -i eth1 -n -p -t > arp_dump Thanks for Shubb for his hint Regards Bassam |
All times are GMT -5. The time now is 02:45 AM. |