ARP Learning notes (Linux High performance service programming)

Let's look at the definition of ARP.

Now Linux runs this command

Tcpdump-i eth0:1-ent ' (DST 192.168.5.190 and src 192.168.5.109) or (DST 192.168.5.109 and src 192.168.5.190) '-X

bc:ee:7b:9d:ee:02 > Broadcast, EtherType ARP (0x0806), length 60:request Who-has 192.168.5.190 tell 192.168.5.109, Len Gth 46
0x0000:0001 0800 0604 0001 bcee 7b9d ee02 c0a8
0x0010:056d 0000 0000 0000 c0a8 05be 0000 0000
0x0020:0000 0000 0000 0000 0000 0000 0000
40:16:7e:79:c7:36 > Bc:ee:7b:9d:ee:02, EtherType ARP (0x0806), length 42:reply 192.168.5.190 is-at 40:16:7e:79:c7:36, Length 28
0x0000:0001 0800 0604 0002 4016 7e79 c736 c0a8
0x0010:05be bcee 7b9d ee02 c0a8 056d

We've also printed out the data in 16.

The packet that requests ARP is analyzed first

0001---Indicates that the hardware type is MAC address

0800---Represents the type of protocol to be mapped, here is the IP address

---Indicates the MAC address length

---Indicates the IP address length

0001---represents an ARP request

Bcee 7b9d EE02---Sender MAC address that's the machine.

C0A8 056d---sender IP 192.168.5.109

0000 0000 0000---Target Mac, this is the whole network, unknown.

C0A8 05be---Target IP address, i.e. 192.168.5.190

Re-analyze the packet for the ARP response

0001---Indicates that the hardware type is MAC address

0800---Represents the type of protocol to be mapped, here is the IP address

---Indicates the MAC address length

---Indicates the IP address length

0002---indicates an ARP response

4016 7e79 c736---sender MAC address

C0A8 05be---Sender IP address

BCEE 7b9d EE02---receive MAC address

C0A8 056d---receiver IP address

The data length of the ARP is less than 46, so it's a rule to fill 0.

ARP Learning notes (Linux High performance service programming)