[Winpcap-users] ask for a arp filter

Guy Harris guy at alum.mit.edu
Sat Mar 24 00:06:49 GMT 2007

On Mar 22, 2007, at 11:29 PM, 欧福瑞 wrote:

> I want capture all the arp packets send from local, some virus build  
> arp packets with wrong info.
> how to write the filter?

	src ether host <MAC address of your machine's network card> and arp

For example, if the MAC address of the machine's Ethernet card is  
00:11:22:33:44:55, try

	src ether host 00:11:22:33:44:55 and arp

More information about the Winpcap-users mailing list