Wireshark ARP protocol for Real-combat analysis (II.)

This section learns how to obtain the ARP protocol package and parse the ARP data.

Before analyzing, first look at the message format of ARP

The image above is the format of ARP request and reply message, which is explained in detail below.

For the Ethernet header:

If the request ARP message, Ethernet Destination address: Is (all 1), is the broadcast, the purpose is to let all hosts on the LAN receive ARP Request packet

Ethernet Source Address: Is the send-side address.

Frame type: If it is an ARP message, the value is 0x0806

Hardware type: Indicates that the ARP protocol is implemented on that type of network, it has a value of 1, which means the Ethernet address

Protocol type: Represents the Resolution Protocol (upper layer Protocol), here is generally 0800, that is, IP

Hardware address length: That is, the MAC address length, which is 6 bytes

Protocol address length: that is, the IP address length, which is 4 bytes

Action type: Represents the ARP protocol datagram type. 1 indicates the request message, 2 means the reply message

Send-side Ethernet address: That is, the source MAC address

Send side IP address: that is, the source IP address

Destination Ethernet Address: target-side MAC address (if Request message, is full 0)

IP address: That is, the IP address of the end of the target

Now that you know the detailed format of the ARP, try to get the ARP message.

Instance:

As shown in the figure above, PC1 sends an ARP request to PC2, at which point the ARP capture data is obtained using Wireshark

Now that you have obtained the ARP data, analyze the ARP data.

The ARP request data message is analyzed first:

With 57 frames selected, you can view the report details in Wireshark:

When the ARP request message sent by PC1 is sent to the LAN in the form of a broadcast, when PC2 detects that the IP address is the same as its own IP, it is sent to the PC1 response message, which is 58 frames

For ARP response packets, the source IP, the IP, the source Mac, and the Mac are all known.

About analyzing ARP sound messages, here's the analysis.