[Winpcap-users] ask for a arp filter

[Guy Harris]

On Mar 22, 2007, at 11:29 PM, 欧福瑞 wrote:

> I want capture all the arp packets send from local, some virus build  
> arp packets with wrong info.
>
> how to write the filter?

	src ether host <MAC address of your machine's network card> and arp

For example, if the MAC address of the machine's Ethernet card is  
00:11:22:33:44:55, try

	src ether host 00:11:22:33:44:55 and arp