Section: arp
Family Number
802 2054

Endian: endian_big
Protocol description
Reference: RFC-826

Todd Lewis protocol commentary: The Address Resolution Protocol is a pretty ancient protocol used on ethernets and ethernet-like networks to associate an IP address with an ethernet MAC address. The protocol as originally written attempts to be protocol-agnostic, but the Hank support for ARP assumes that the protocol of the addresses exported is IPv4, which is virtually alwaye the case and is a usual assumption among protocol analysis and NIDS programs.

Name: Hdr
Name: Hdr
Field name Field type Field size Field description
hardware_address_space Integer 16 Hardware address space (e.g., Ethernet, Packet Radio Net.)
protocol_address_space Integer 16 Protocol address space. For Ethernet hardware, this is from the set of type fields ether_typ$<protocol>.
hardware_address_length Integer 8 byte length of each hardware address
protocol_address_length Integer 8 byte length of each protocol address
operation_code Integer 16 opcode (ares_op$REQUEST | ares_op$REPLY)
sender_hardware_address Integer 6 Hardware address of sender of this packet, n from the ar$hln field.
sender_protocol_address Integer 32 Protocol address of sender of this packet, m from the ar$pln field.
target_hardware_address Integer 6 Hardware address of target of this packet (if known).
target_protocol_address Integer 32 Protocol address of target.

RCS ID: "$Id: arp.xml,v 1.2 2001/10/29 06:23:30 tlewis Exp $"