tcpdump -p arp
tcpdump: listening on eth0
10:30:43.935182 arp who-has 192.168.1.20 tell 192.168.1.1
10:30:43.935423 arp reply 192.168.1.20 is-at 0:d:60:11:60:80