Wireshark-users: Re: [Wireshark-users] why Wiresharks works (and tcpdump doesn't)

From: Martin Visser <martinvisser99@xxxxxxxxx>
Date: Fri, 8 May 2009 16:48:04 +1000

You might need to be a bit clearer on your physical network
configuration - where you are connecting tcpdump/wireshark - for us to
understand.

One thing to note is that "arp" is constrained within a broadcast,
which often is one subnet. Thus if you ask tcpdump to only show "arp"
packets you will only arp's on your local network - not from those on
the other side of a router, and hence in a different subnet

Regards, Martin

MartinVisser99@xxxxxxxxx



On Fri, May 8, 2009 at 3:23 PM, Rogelio <scubacuda@xxxxxxxxx> wrote:
> My question is not so much around Wireshark, but rather why I have to
> use Wireshark rather than use tcpdump to find an unknown address of a
> network device.
>
> (i.e. Say I have a router, and someone gave the internal interface some
> stupid IP, such as 1.2.3.4.  If my laptop is on the same subnet, then
> the command "tcpdump -i eth0 arp") finds the IP okay.  But if it's not,
> then I don't see that IP.  When I start Wireshark, however, I see the IP
> of the network device fly by.)
>
> Any pointers in the right direction would be greatly appreciated.
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
>