Wireshark · Wireshark-users: Re: [Wireshark-users] why Wiresharks works (and tcpdump doesn't)

[Rogelio <scubacuda@xxxxxxxxx>]

Martin Visser wrote:
> You might need to be a bit clearer on your physical network
> configuration - where you are connecting tcpdump/wireshark - for us to
> understand.

Just a crossover cable from my laptop to the networking device.

> One thing to note is that "arp" is constrained within a broadcast,
> which often is one subnet. Thus if you ask tcpdump to only show "arp"
> packets you will only arp's on your local network - not from those on
> the other side of a router, and hence in a different subnet

That would explain it.  tcpdump searching for the arp string only works 
for IPs in the same subnet; Wireshark shows everything.

Thanks!