> ether proto arp
Well, yes, that'll give you plenty of ARP requests - in fact, it should
give you nothing *but* ARP requests, because it's saying "show me only
packets with ARP as the Ethernet-layer protocol identifier".
> ether host [host]
Well, if the ARP packets in question are coming from or going to that
host, that'll show you those ARP requests.
> ether src [host]
If the ARP packets are coming from that host, that'll show you those ARP
requests.
> ether dst [host]
If the ARP packets are being sent to that host, that'll show you those
ARP requests (although I'd expect them to be sent to ff:ff:ff:ff:ff:ff)
> arp
See previous comment about "ether proto arp".
> ether broadcast
If the ARP packets are broadcast, that'll show them to you.
Capture (and display) filter expressions specify the packets you *DO*
want to see; they do *NOT* specify the packets you want filtered *OUT*
of the capture or display. (I'm not sure I've *ever* seen a packet
capture program where the capture filter expression specifies the types
of packets *not* to be captured.) If you want to see packets that aren't
ARP packets, try
not arp
