--- a/arpwatch/arpwatch.c +++ a/arpwatch/arpwatch.c @@ -309,7 +309,7 @@ main(int argc, char **argv) snaplen = max(sizeof(struct ether_header), sizeof(struct fddi_header)) + sizeof(struct ether_arp); if (strcmp(interface, "any") == 0) - snaplen = sizeof(struct lcc_header) + sizeof(struct ether_arp); + snaplen = sizeof(struct lcc_header) + sizeof(struct ether_arp)+1; timeout = 1000; pd = pcap_open_live(interface, snaplen, 1, timeout, errbuf); if (pd == NULL) {