My question is not so much around Wireshark, but rather why I have to
use Wireshark rather than use tcpdump to find an unknown address of a
network device.
(i.e. Say I have a router, and someone gave the internal interface some
stupid IP, such as 1.2.3.4. If my laptop is on the same subnet, then
the command "tcpdump -i eth0 arp") finds the IP okay. But if it's not,
then I don't see that IP. When I start Wireshark, however, I see the IP
of the network device fly by.)
Any pointers in the right direction would be greatly appreciated.