Linux ARP Protocol __linux

When communicating on the network, the source host's application knows the destination host's IP address and the port number, but does not know the destination host's hardware address, but the data packet first is receives by the network card to handle the upper layer protocol, if receives the data packet the hardware address does not match this machine, then discards directly. Therefore, you must obtain the hardware address of the destination host before you communicate. The ARP protocol works.
The source host sends an ARP request asking "What is the hardware address of the 192.168.0.1 host" and broadcasts the request to the local network segment (the hardware address of the Ethernet frame header fills FF:FF:FF:FF:FF:FF for broadcast), and the destination host receives the broadcast ARP request, If the IP address is found to be the same as this one, send an ARP reply packet to the source host and fill in the answer package with your hardware address.

Each host maintains an ARP cache table, which can be viewed with the arp-a command. The table entries in the cached table have an expiration time (typically 20 minutes), and if a table entry is not used again within 20 minutes, the table entry is invalidated and the next time an ARP request is sent to obtain the hardware address of the destination host.

The format of the ARP datagram is as follows:

The source MAC address, destination MAC address occurs once in the Ethernet header and ARP requests, and is redundant for the link layer Ethernet, but it may be necessary if the link layer is a different type of network.

The hardware type refers to the link layer network type, 1 for Ethernet, protocol type refers to the type of address to be converted, 0x0800 is the IP address, the following two address length for Ethernet address and IP address 6 and 4 (bytes), op field is 1 for ARP request, OP field is 2 table ⽰ ARP reply.

For the Ethernet header: If the ARP message is requested,

Ethernet Destination Address: Is (all 1), is the broadcast newspaper, the purpose is to let all hosts on the same LAN receive ARP Request packet Ethernet Source address: Is the sender's address.

Frame type: If it is an ARP message, the value is 0x0806 hardware type: Indicates that the ARP protocol is implemented on that type of network with a value of 1, which means Ethernet address

Protocol type: Represents the Resolution Protocol (upper layer Protocol), which is typically 0800, that is, the IP hardware address length: That is, the MAC address length, that is, 6 bytes

Protocol address length: that is, the IP address length, that is, 4 bytes

Action type: Represents the ARP datagram type. 1ARP means the request package, 2ARP represents the reply packet, 3 represents the RARP request package, and 4 represents the RARP reply package

Send-side Ethernet address: That is, the source MAC address sender IP address: That is, the source IP address destination Ethernet address: target-side MAC address (if is the request message, is all 0)

Head IP Address: The IP address of the target end

Write ARP script to crawl the corresponding host MAC address:
arp.sh

#!/bin/bash

i=1
count=0 while
[$i-le 254]


do
    if [$count-gt
        ];then-Sleep count=0 >fi
    ping-c1 "192.168.0. $i" & Let

    i++ let
    count++

do

Run Result:

As you can see, two computers have been connected to the network.