I am getting this outputlines from tcpdump:
- <ts> Out a0:36:9f:12:8a:39 ethertype ARP (0x0806), length 44: Request who-has 192.168.12.254 tell 0.0.0.0, length 28
<ts> In 00:10:b5:da:98:0b ethertype ARP (0x0806), length 62: Reply 192.168.12.254 is-at 00:10:b5:da:98:0b, length 46
<ts> B 00:10:b5:da:98:0b ethertype ARP (0x0806), length 62: Request who-has 192.168.12.139 tell 192.168.12.254, length 46
<ts> M b8:27:eb:e3:2a:e8 ethertype ARP (0x0806), length 62: Request who-has 192.168.12.10 tell 192.168.12.6, length 46
flags in the output, where "Out" and "In" are really not the question
The output above was modified by me to make it short [and <ts> is just the timestamp].
The two flags in question are bold and underlined.
Thanks,
Manfred