Wireshark-users: [Wireshark-users] why Wiresharks works (and tcpdump doesn't)

From: Rogelio <scubacuda@xxxxxxxxx>
Date: Thu, 07 May 2009 22:23:00 -0700

My question is not so much around Wireshark, but rather why I have to use Wireshark rather than use tcpdump to find an unknown address of a network device.

(i.e. Say I have a router, and someone gave the internal interface some stupid IP, such as 1.2.3.4. If my laptop is on the same subnet, then the command "tcpdump -i eth0 arp") finds the IP okay. But if it's not, then I don't see that IP. When I start Wireshark, however, I see the IP of the network device fly by.)

Any pointers in the right direction would be greatly appreciated.