6

Is there a BPF expression that would only capture arp-reply packets? Currently, I am using Pcap4J and the following BPF expression:

arp and dst host host and ether dst mac

where host is the IP address of my device and mac is the MAC address of my primary network interface. Unfortunately, when packets are captured, this filter allows ARP broadcast requests to also be captured, so I have to take an extra step to check if the operation field of the ARP header is 2 and not 1.

1 Answer 1

7

Try this:

(arp[6:2] = 2) and dst host host and ether dst mac

2
  • You my friend, are a genius. Can you explain what the 6:2 index is doing? Oct 23, 2016 at 17:09
  • 4
    The 6 is the offset in ARP header, where the operation field starts. The 2 is the field's length. arp[6:2] returns the operation field's value.
    – kaitoy
    Oct 23, 2016 at 23:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.