fix tcpdump expression, lowercase arp