Re: filter garp packets

[Jaap Keuter <jaap.keuter () xs4all nl>]

Hi,

Use this instead:

arp.isgratuitous == 1

(it's a hidden field *)

Thanks,
Jaap


*) It says in the source code hidden fields are poor design, since the user 
cannot expect to know they are there. This is one example of it.



On 04/11/2012 10:17 PM, Koneru Srikanth wrote:
> Hi all
> garp packets are arp packets with spa=tpa
> However I cannot use that as a filter
> arp.src.proto_ipv4 == arp.dst.proto_ipv4
>
> RHS expects a hostname or ip address
> Kindly share any known method of sharing
>
> Thanks
> Srikanth KP

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request () wireshark org?subject=unsubscribe