$sudo tcpdump -n -i eth0 arp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
19:29:14.472222 arp who-has 192.168.16.254 tell 192.168.16.211
19:29:19.783784 arp reply 192.168.16.4 is-at 00:16:3e:00:00:07
19:29:29.796413 arp reply 192.168.16.4 is-at 00:16:3e:00:00:07
19:29:30.923372 arp who-has 192.168.16.254 tell 192.168.16.202
19:29:39.809044 arp reply 192.168.16.4 is-at 00:16:3e:00:00:07
19:29:49.821667 arp reply 192.168.16.4 is-at 00:16:3e:00:00:07
19:29:59.834293 arp reply 192.168.16.4 is-at 00:16:3e:00:00:07
19:30:09.846899 arp reply 192.168.16.4 is-at 00:16:3e:00:00:07
19:30:19.859553 arp reply 192.168.16.4 is-at 00:16:3e:00:00:07
19:30:26.448070 arp who-has 192.168.16.26 tell 192.168.16.254
19:30:26.448090 arp who-has 192.168.16.27 tell 192.168.16.254
19:30:27.118090 arp who-has 192.168.16.25 tell 192.168.16.254
19:30:27.568166 arp who-has 192.168.16.21 tell 192.168.16.254
19:30:27.598271 arp who-has 192.168.16.24 tell 192.168.16.254
19:30:27.738378 arp who-has 192.168.16.22 tell 192.168.16.254
19:30:29.872163 arp reply 192.168.16.4 is-at 00:16:3e:00:00:07
19:30:39.884800 arp reply 192.168.16.4 is-at 00:16:3e:00:00:07
19:30:49.897515 arp reply 192.168.16.4 is-at 00:16:3e:00:00:07
19:30:52.487922 arp reply 192.168.16.4 is-at 00:16:3e:00:00:04
19:30:53.501623 arp reply 192.168.16.4 is-at 00:16:3e:00:00:04
19:30:54.519874 arp reply 192.168.16.4 is-at 00:16:3e:00:00:04
19:30:57.357215 arp who-has 192.168.16.254 tell 192.168.16.7
22 packets captured
22 packets received by filter
0 packets dropped by kernel