Solved FreeBSD-12.3 Find the elusive arp.duplicate-address-frame filter

[byrnejb]

I wish to use this filter. I can find references to it aplenty. But, I cannot locate the filter itself. Does anyone here have it and care to share?

 

[SirDice]

I can find references to it aplenty

I can't even find those. Would you mind posting some of them?

 

[byrnejb]

I can't even find those. Would you mind posting some of them?

Complete list of Wireshark filters: https://wiki.wireshark.org/CaptureFilters. Display filters are found at: https://www.wireshark.org/docs/dfref/. From comments I have read I infer that these are supposed to come with Wireshark and it is assumed that they are directly available through the Capture > Capture Filters interface of Wireshark. But they definitely do not ship with the FreeBSD port.

 

[VladiBG]

Wireshark • Go Deep | Display Filter Reference: Address Resolution Protocol

Wireshark: The world's most popular network protocol analyzer

www.wireshark.org

 

[byrnejb]

According to the maintainer the arp.duplicate-address-frame filter is built into Wireshark. So there is not an external filter string to find. It appears that this is a display filter, which I had not realized. So, it appears that the capture filter would be something like ip to get all of them on an i/f and the display filter arp.duplicate-address-detected just shows the hits, if any. This is speculation on my part. I have not tested this yet.