Wireshark-users: Re: [Wireshark-users] why Wiresharks works (and tcpdump doesn't)
You might need to be a bit clearer on your physical network
configuration - where you are connecting tcpdump/wireshark - for us to
understand.
One thing to note is that "arp" is constrained within a broadcast,
which often is one subnet. Thus if you ask tcpdump to only show "arp"
packets you will only arp's on your local network - not from those on
the other side of a router, and hence in a different subnet
Regards, Martin
MartinVisser99@xxxxxxxxx
On Fri, May 8, 2009 at 3:23 PM, Rogelio <scubacuda@xxxxxxxxx> wrote:
> My question is not so much around Wireshark, but rather why I have to
> use Wireshark rather than use tcpdump to find an unknown address of a
> network device.
>
> (i.e. Say I have a router, and someone gave the internal interface some
> stupid IP, such as 1.2.3.4. If my laptop is on the same subnet, then
> the command "tcpdump -i eth0 arp") finds the IP okay. But if it's not,
> then I don't see that IP. When I start Wireshark, however, I see the IP
> of the network device fly by.)
>
> Any pointers in the right direction would be greatly appreciated.
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
>
