Noodle of Death Noodle of Death - 1 year ago 174
Java Question

BPF expression to capture only arp-reply packets

Is there a BPF expression that would only capture arp-reply packets? Currently, I am using Pcap4J and the following BPF expression:

arp and dst host host and ether dst mac

where host is the IP address of my device and mac is the MAC address of my primary network interface. Unfortunately, when packets are captured, this filter allows ARP broadcast requests to also be captured, so I have to take an extra step to check if the operation field of the ARP header is 2 and not 1.

Answer Source

Try this:

(arp[6:2] = 2) and dst host host and ether dst mac

Recommended from our users: Dynamic Network Monitoring from WhatsUp Gold from IPSwitch. Free Download