Hello Guys,
I really need ur urgen help.
I have Linux box that works as a gateway, eth0 is connected to the Internet and eth1 in connected to my LAN. I want to monitore all the arp requests issued by all the machines connected to my LAN and I want to execlude the arp requests issued by eth1 itself.

I need to capture only one arp request at a time and then save it inside a file.

I am using the following istruction, but the problme it captures the arp requests of the eth1 itself and I don't know how to exclude them.

tcpdump 'arp' -c 1 -e -i eth1 -n -p -t > arp_dump



Regards
Bassam

grep to the rescue

tcpdump 'arp' -c 1 -e -i eth1 -n -p -t | grep -v something > arp_dump

where 'something' is whatever is unique about the output you don't want to log

see also egrep -v "packets|tcpdump|listening|something" for more compact output

All the arp requests are similar and there is nothing in the arp requests makes me able to distinguish and differantiate between them, I mean I can not distinguish whether the arp request has been issued from the monitoring machin or not.
It should be done internally by the tcpdump itself, I mean by captureing the arp requests from all the machins other than the monitoring machin

if it's issued from the monitoring machine it should start with:
eth1_mac_address >

and end with:

tell eth1_ip_address