Hi, According to this link http://www.tcpipguide.com/free/t_ARPMessageFormat.htm the protocol number for ARP should be 2048. Thus using this h->extended_hdr.parsed_pkt.l3_proto will be suffice to capture it in pf_ring??
_______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
