结构ether_header定义了以太网帧首部;结构arphdr定义了其后的5个字段,其信息用于在任何类型的介质上传送ARP请求和回答;ether_arp结构除了包含arphdr结构外,还包含源主机和目的主机的地址。定义常
#define EPT_IP 0x0800 /* type: IP */ #define EPT_ARP 0x0806 /* type: ARP */ #define EPT_RARP 0x8035 /* type: RARP */ #define ARP_HARDWARE 0x0001 /* Dummy type for 802.3 frames */ #define ARP_REQUEST 0x0001 /* ARP request */ #define ARP_REPLY 0x0002 /* ARP reply */
定义以太网首部
struct sniff_ethernet{ u_char ether_dhost[ETHER_ADDR_LEN]; u_char ether_shost[ETHER_ADDR_LEN]; u_short ether_type; };定义以太网arp字段
typedef struct aprhdr{ u_int16_t htype; //Hardware type u_int16_t ptype; //protocol type u_char hlen; //Hardware address length u_char plen; //protocol address length u_int16_t oper; //operation code u_char sha[6]; //sender hardware address u_char spa[4]; //sender ip address u_char tha[6]; //target hardware address u_char tpa[4]; //target ip address }arphdr_t;定义整个arp报文包,总长度42字节
typedef struct arpPacket { EHHDR ehhdr; ARPHDR arphdr; } ARPPACKET, *PARPPACKET;
ARP请求包的分析:如下所示为一个ARP请求包
0000 ff ff ff ff ff ff 00 0c f1 d4 d9 60 08 06 00 01 ...........`....