jim@... <jim@...> writes:
> It's a pseudo field that is generated by Wireshark and isn't actually
> present in the frame, but it's not hidden. If you expand an ARP request,
> you'll see a line that says either "[Is gratuitous: False]" or "[Is
> gratuitous: True]". You can right-click that line and select "Apply as
> Filter" or "Prepare a Filter" just like any other filterable field.
You can also find it:
1) Internals -> Supported Protocols (slow!) -> Display Filter Fields -> scroll
down to "ARP/RARP - Address Resolution Protocol (arp) [34 fields]:" ->
arp.isgratuitous
2) From the filter toolbar: Expression... -> Field name = "ARP/RARP - Address
Resolution Protocol" -> arp.isgratuitous
3) Analyze -> Display Filters... -> Expression... -> Field name = "ARP/RARP -
Address Resolution Protocol" -> arp.isgratuitous
4) On-line display filter documentation:
http://www.wireshark.org/docs/dfref/a/arp.html
