I'm trying to make my Pi listen for ARP broadcasts on my wireless network, to detect an Amazon Dash Button button press. When I push the button, it broadcasts an ARP request to find the network gateway. I can see this request using
tcpdump on my laptop, but not on my Pi. Here's the output on each when I push the button and filter on the button's MAC address:
Laptop: (expected output)
$ sudo tcpdump ether host fc:a6:67:1d:ab:cd -n listening on wlp2s0, link-type EN10MB (Ethernet), capture size 262144 bytes 08:23:51.025847 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from fc:a6:67:1d:ab:cd, length 261 08:23:51.028398 ARP, Request who-has 192.168.1.1 tell 192.168.1.11, length 28
$ sudo tcpdump ether host fc:a6:67:1d:ab:cd -n listening on wlan0, link-type EN10MB (Ethernet), capture size 262144 bytes 12:23:50.950669 EAPOL key (3) v2, len 95 12:23:50.952511 EAPOL key (3) v2, len 117 12:23:50.953982 EAPOL key (3) v2, len 151 12:23:50.964768 EAPOL key (3) v2, len 95 12:23:51.036188 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from fc:a6:67:1d:ab:cd, length 261
Apparently both are seeing some traffic from the button press, including the BOOTP/DHCP request, but the Pi sees only some EAPOL traffic, while the laptop sees only the ARP request.
I have the same issue using
scapyscanner in Python, so I assume this is a problem with the wireless driver or configuration.
The Pi can see its own ARP traffic in
tcpdump, i.e., when the Pi itself sends out a
who-hasrequest or gets a response to one of its own requests, those ARP packets do show up in
tcpdumpoutput. The Pi fails to capture all ARP broadcasts that don't directly concern it.
I'm sure the broadcast is physically reaching the Pi.
What can I do to capture ARP traffic on my Pi?