Martin Visser wrote:
You might need to be a bit clearer on your physical network
configuration - where you are connecting tcpdump/wireshark - for us to
understand.
Just a crossover cable from my laptop to the networking device.
One thing to note is that "arp" is constrained within a broadcast,
which often is one subnet. Thus if you ask tcpdump to only show "arp"
packets you will only arp's on your local network - not from those on
the other side of a router, and hence in a different subnet
That would explain it. tcpdump searching for the arp string only works
for IPs in the same subnet; Wireshark shows everything.
Thanks!