Wireshark

  • Riverbed Technology
  • WinPcap
the world's foremost network protocol analyzer
  • Wireshark
    • About
    • Download
    • Blog
  • Get Help
    • Ask a Question
    • FAQs
    • Documentation
    • Mailing Lists
    • Online Tools
    • Wiki
    • Bug Tracker
  • Develop
    • Get Involved
    • Developer's Guide
    • Browse the Code
    • Latest Builds

Display Filter Reference: Address Resolution Protocol

Protocol field name: arp
Versions: 1.0.0 to 1.6.5

Back to Display Filter Reference

Field name Type Description Versions
arp.dst.atm_num_e164 Character string Target ATM number (E.164) 1.0.0 to 1.6.5
arp.dst.atm_num_nsap Sequence of bytes Target ATM number (NSAP) 1.0.0 to 1.6.5
arp.dst.atm_subaddr Sequence of bytes Target ATM subaddress 1.0.0 to 1.6.5
arp.dst.hlen Unsigned integer, 1 byte Target ATM number length 1.0.0 to 1.6.5
arp.dst.htype Boolean Target ATM number type 1.0.0 to 1.6.5
arp.dst.hw Sequence of bytes Target hardware address 1.0.0 to 1.6.5
arp.dst.hw_mac Ethernet or other MAC address Target MAC address 1.0.0 to 1.6.5
arp.dst.pln Unsigned integer, 1 byte Target protocol size 1.0.0 to 1.6.5
arp.dst.proto Sequence of bytes Target protocol address 1.0.0 to 1.6.5
arp.dst.proto_ipv4 IPv4 address Target IP address 1.0.0 to 1.6.5
arp.dst.slen Unsigned integer, 1 byte Target ATM subaddress length 1.0.0 to 1.6.5
arp.dst.stype Boolean Target ATM subaddress type 1.0.0 to 1.6.5
arp.duplicate-address-detected Label Duplicate IP address detected 1.0.0 to 1.6.5
arp.duplicate-address-frame Frame number Frame showing earlier use of IP address 1.0.0 to 1.6.5
arp.hw.size Unsigned integer, 1 byte Hardware size 1.0.0 to 1.6.5
arp.hw.type Unsigned integer, 2 bytes Hardware type 1.0.0 to 1.6.5
arp.isgratuitous Boolean Is gratuitous 1.2.0 to 1.6.5
arp.opcode Unsigned integer, 2 bytes Opcode 1.0.0 to 1.6.5
arp.packet-storm-detected Label Packet storm detected 1.0.0 to 1.6.5
arp.proto.size Unsigned integer, 1 byte Protocol size 1.0.0 to 1.6.5
arp.proto.type Unsigned integer, 2 bytes Protocol type 1.0.0 to 1.6.5
arp.seconds-since-duplicate-address-frame Unsigned integer, 4 bytes Seconds since earlier frame seen 1.0.0 to 1.6.5
arp.src.atm_num_e164 Character string Sender ATM number (E.164) 1.0.0 to 1.6.5
arp.src.atm_num_nsap Sequence of bytes Sender ATM number (NSAP) 1.0.0 to 1.6.5
arp.src.atm_subaddr Sequence of bytes Sender ATM subaddress 1.0.0 to 1.6.5
arp.src.hlen Unsigned integer, 1 byte Sender ATM number length 1.0.0 to 1.6.5
arp.src.htype Boolean Sender ATM number type 1.0.0 to 1.6.5
arp.src.hw Sequence of bytes Sender hardware address 1.0.0 to 1.6.5
arp.src.hw_mac Ethernet or other MAC address Sender MAC address 1.0.0 to 1.6.5
arp.src.pln Unsigned integer, 1 byte Sender protocol size 1.0.0 to 1.6.5
arp.src.proto Sequence of bytes Sender protocol address 1.0.0 to 1.6.5
arp.src.proto_ipv4 IPv4 address Sender IP address 1.0.0 to 1.6.5
arp.src.slen Unsigned integer, 1 byte Sender ATM subaddress length 1.0.0 to 1.6.5
arp.src.stype Boolean Sender ATM subaddress type 1.0.0 to 1.6.5

Wireshark and the "fin" logo are registered trademarks of the Wireshark Foundation