Computer Systems Engineering Technology Department

CST 415 - Computer Networks



In this project you will be parsing out the ARP header and implementing the ARP algorithm and send out ARP response packets when an ARP request is received.  The ARP format can be either ARP or RARP. Your job is to parse out these fields correctly and display them, then if the packet is an ARP request, send out the appropriate response.  Once again, the Ethernet header is:

In this project, you will parse the MAC client data (Layer 3) when the Ethernet frame has a Length/Type field which identifies the packet as an ARP or RARP packet. An ARP/RARP packet has the format:

    0                   1                   2                3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   |     Hardware Address          |       Protocol Address        |
   | H Addr Len    | P Addr Len    | Operation (Request or Reply)  |
   | Hardware Address of sender for H Addr Len bytes               |
   |    ....
   |    ....
   | Protocol Address of sender for P Addr Len bytes               |
   |    ....
   |    ....
   | Hardware Address of target for H Addr Len bytes               |
   |    ....
   |    ....
   | Protocol Address of target for P Addr Len bytes               |
   |    ....
   |    ....
                                The ARP Header

Note that each tick mark represents one bit position.

Hardware Address: 2 bytes

The type of  hardware address (Ethernet for us). The types are listed in the following table. Look for 1, 2, and 6. On campus, we should only see 1, however, on your home networks, you may see other types. Extra credit on this lab if you can prove you see something other than "1" on any network you are monitoring

Number      Hardware Type (hrd)                                  References (see RFC 1700)
---------     -----------------------------------              ------------
1                 Ethernet (10Mb)                                          [JBP]
2                 Experimental Ethernet (3Mb)                        [JBP]
3                 Amateur Radio AX.25                                  [PXK]
4                 Proteon ProNET Token Ring                        [JBP]
5                 Chaos                                                           [GXP]
6                 IEEE 802 Networks                                     [JBP]
7                 ARCNET                                                     [JBP]
8                 Hyperchannel                                                [JBP]
9                 Lanstar                                                          [TU]
10               Autonet Short Address                                  [MXB1]
11               LocalTalk                                                      [JKR1]
12               LocalNet (IBM PCNet or SYTEK LocalNET) [JXM]
13               Ultra link                                                        [RXD2]
14               SMDS                                                           [GXC1]
15               Frame Relay                                                  [AGM]
16               Asynchronous Transmission Mode (ATM)     [JXB2]
17               HDLC                                                           [JBP]
18               Fibre Channel                                                [Yakov Rekhter]
19               Asynchronous Transmission Mode (ATM)     [Mark Laubach]
20               Serial Line                                                     [JBP]
21               Asynchronous Transmission Mode (ATM)     [MXB1]

Protocol Address: 2 bytes

The type of  protocol address (IP for us).

H Addr Len: 8 bits

The length of the hardware address in bytes.

P Addr Len: 8 bits

The length of the protocol address in bytes.

Operation: 2 bytes

1 - ARP Request

2 - ARP Reply

3 - RARP Request

4 - RARP Reply

Hardware Address of Sender: "n" bytes

For us, this will be the Ethernet MAC address - 6 bytes. An ARP request and reply should have this set. A RARP request should not have this set. A RARP reply should have this set.

Protocol  Address of Sender: "n" bytes

For us, this will be the IP address - 4 bytes. An ARP request and reply should have this set. A RARP request and reply should have this set.

Hardware Address of Target: "n" bytes

For us, this will be the Ethernet MAC address - 6 bytes. An ARP request will not have this set. An ARP reply will have this set.  For a RARP request and reply, in the case where the sender wishes to determine his own protocol address, this will be the hardware address of the sender.

Protocol  Address of Target: "n" bytes

For us, this will be the IP address - 4 bytes. An ARP request and reply should have this set. In a RARP request this is undefined. In a RARP reply this is set.

This field indicates where in the datagram this fragment belongs.

For the generation and sending ARP responses, see:


Programming Requirements

Packet Dump

You must print out the following information as extracted from the incoming packet:

     ETHER:  ----- Ether Header -----
     ETHER:  Packet size : 210 bytes
     ETHER:  Destination : 08-00-20-01-3d-94   Type: Individual Global
     ETHER:  Source      : 08-00-69-01-5f-0e        Type: Individual Global
     ETHER:  Ethertype   : 0800 (IP) (Note: Here it prints either ARP, IP, or UNKNOWN)

     ARP:  ----- ARP/RARP Frame -----
     ARP:  Hardware type = 1
     ARP:  Protocol type = 0800 (IP)
     ARP:  Length of hardware address = 6 bytes
     ARP:  Length of protocol address = 4 bytes
     ARP:  Opcode 1 (ARP Request)
     ARP:  Sender's hardware address = 0:aa:0:a2:ec:fa
     ARP:  Sender's protocol address =, xinu101.cs.purdue.edu
     ARP:  Target hardware address = ?
     ARP:  Target protocol address =, helga.cs.purdue.edu

--------------- ASCII Dump - Hex ------------------------------------ ASCII Dump - ASCII -----------------------

In addition to providing the above report, add the logic that will enable the user to change the type of packets being filtered from IP to ARP to All. This should be done from the command line while the packet analyzer is running.

To generate ARP packets, try pinging a non-existing host (like This command triggers an ARP request because the local host does not have the hardware address of the non-existing host in the ARP cache.

On your workstation type:



Project Requirements Summary:

  1. Acquire the packet buffer and parse and label:
    1. Layer 2 (Ethernet) - Done in the first lab.
    2. Layer 3 (IP) - Done in the second lab.
    3. Layer 3 (ARP)
      1. Hardware Address Type
      2. Protocol Address Type
      3. Hardware Address Length
      4. Protocol Address Length
      5. Operation
      6. Hardware Address of Sender
      7. Protocol Address of Sender
      8. Hardware Address of Target
      9. Protocol Address of Target
  2. Hex Dump Packet.
  3. Create a local ARP cache.
    1. Display ARP Cache contents
    2. Clear ARP Cache contents
    3. ARP cache must be limited to four addresses. Apply the cache aging rules.
  4. Upon receiving an ARP request for your computer.
    1. Update your ARP cache
    2. Upon receiving a targeted ARP request, create the appropriate ARP response
    3. Send the ARP response to the requesting computer