Wireshark-users: Re: [Wireshark-users] why Wiresharks works (and tcpdump doesn't)

From: Rogelio <scubacuda@xxxxxxxxx>
Date: Fri, 08 May 2009 00:21:18 -0700

Martin Visser wrote:

You might need to be a bit clearer on your physical network
configuration - where you are connecting tcpdump/wireshark - for us to
understand.

Just a crossover cable from my laptop to the networking device.

One thing to note is that "arp" is constrained within a broadcast,
which often is one subnet. Thus if you ask tcpdump to only show "arp"
packets you will only arp's on your local network - not from those on
the other side of a router, and hence in a different subnet

That would explain it. tcpdump searching for the arp string only works for IPs in the same subnet; Wireshark shows everything.

Thanks!