wireshar for IP ARP

I wish to apply a display filter to a Wireshark capture that contains several ARP exchanges when no filter is applied.
I have tried three different filters (one at a time) as follows:
 ip.proto == ARP
 ip.proto == 0x0806
 ip.proto == 2054
 but in either case, when the filter is applied there are no packets shown.

What filter should I be applying ?

I am using Version 1.6.5 (SVN Rev 40429 from /trunk-1.6)
LVL 2
alcindorAsked:
Who is Participating?
 
Zephyr ICTConnect With a Mentor Cloud ArchitectCommented:
I thought it was just arp to filter arp ...

So to filter arp just put "arp" in the filter part. Or maybe "ether proto \arp "

Unless you're trying to really filter something specific??
0
 
giltjrConnect With a Mentor Commented:
You can either just put ARP or eth.type == 0x0806

ARP is not an IP protocol it is a protocol "equal" to IP.
0
 
alcindorAuthor Commented:
Thanks guys
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.