How to monitor the ARP requests from other than eth1

Bassam · 02-08-2004, 10:56 PM

Hi All
I am trying to monitor the arp requests for all the machines connected to my LAN through eth1. I am using the following tcpdump instruction:

tcpdump 'arp' -e -i eth1 -n -p -t

that instruction is working perfectly, but how can I exclude the arp requests of the eth1 itself. I want to receive the arp requests for all the machine in my LAN except for the eth1 which is fixed on the monitoring machine

Thanks for help in advanced

Regards
Bassam

shubb · 02-09-2004, 07:25 PM

You can try the following:

tcpdump not ether host <your MAC address> |grep arp

Bassam · 02-09-2004, 09:45 PM

Hi Shubb,
I tried the your instruction, but unfortunately it is monitoring the eth0 since my Linux box is a gateway and it contains 2 NIC, eth0 is connected to the Internet and eth1 is connected to my internal LAN. So that I want only to capture the ARP requests issued by all the machines connected to my LAN except for eth1.

The instruction that u suggested monitores the eth0 on my Linux box.

Thanks
Bassam

shubb · 02-09-2004, 11:50 PM

Ok, then add the "-i eth1" to switch interfaces.

Bassam · 02-10-2004, 03:25 AM

Ok Guys, I solved the problem. The instruction should be:

tcpdump -c 1 -e not ether src host 00:50:BA:C3:81:3B and arp and not rarp -i eth1 -n -p -t > arp_dump

Thanks for Shubb for his hint

Regards
Bassam