Documentation
¶
Overview ¶
Package arpdecode decodes Address Resolution Protocol (ARP) and Reverse ARP (RARP) packets per RFC 826 + RFC 903 + the RFC 5227 IPv4 address-conflict-detection extensions (gratuitous ARP / ARP probe / ARP announcement).
Wrap-vs-native judgement
Native. RFC 826 is fully public (one of the oldest standards-track RFCs from 1982); ARP wire format is a tight 8-byte fixed header followed by 4 length- parameterised address fields. No crypto, no compression, no varints. Operators paste ARP-payload bytes (after the Ethernet header strip; EtherType 0x0806 for ARP or 0x8035 for RARP) from a `tcpdump -i ethX -X ether proto arp` line, a Wireshark Follow-Frame view, or any ARP-emitting tool and get every documented field plus the higher-level RFC 5227 detection patterns.
What this package covers
**8-byte fixed header**:
Hardware Type (2 bytes BE): 11-entry name table per IANA (1 Ethernet / 6 IEEE 802 / 7 ARCNET / 15 Frame Relay / 16 ATM / 17 HDLC / 18 Fibre Channel / 19 ATM (alternate) / 20 Serial Line / 32 InfiniBand).
Protocol Type (2 bytes BE): the EtherType of the protocol address being resolved. 4 documented: 0x0800 IPv4 / 0x86DD IPv6 / 0x8035 RARP / 0x809B AppleTalk.
HLEN (1 byte): hardware address length, typically 6 for Ethernet.
PLEN (1 byte): protocol address length, typically 4 for IPv4 or 16 for IPv6.
Operation (2 bytes BE) with **10-entry name table**: 1 Request / 2 Reply / 3 RARP Request / 4 RARP Reply / 5 DRARP-Request / 6 DRARP-Reply / 7 DRARP-Error / 8 InARP-Request / 9 InARP-Reply / 10 ARP-NAK.
**4 address fields** (sizes from HLEN / PLEN):
Sender Hardware Address (HLEN bytes; formatted as MAC for HLEN=6).
Sender Protocol Address (PLEN bytes; formatted as IPv4 for PLEN=4, IPv6 for PLEN=16).
Target Hardware Address (HLEN bytes).
Target Protocol Address (PLEN bytes).
**RFC 5227 detection patterns** for IPv4 ARP:
**Gratuitous ARP**: opcode is Request or Reply AND Sender Protocol Address == Target Protocol Address. Used for unsolicited announcement that an IP is claimed by this MAC.
**ARP Probe** (RFC 5227 §1.1): opcode Request AND Sender Protocol Address == 0.0.0.0 AND Target Protocol Address is the address being probed (host sends this before claiming the address to detect conflicts).
**ARP Announcement** (RFC 5227 §1.2): opcode Request AND Sender Protocol Address == Target Protocol Address (similar to gratuitous but specifically the post-probe announcement).
What this package does NOT cover (deliberately out of scope)
Ethernet framing — feed the ARP payload bytes after the dst MAC + src MAC + EtherType bytes.
Neighbor Discovery Protocol (IPv6's ARP replacement) — already handled by `icmp_packet_decode` (NDP Neighbor Solicitation / Advertisement / Redirect).
802.1Q VLAN tag stripping — feed the post-tag ARP payload.
ARP table state — we decode individual packets; ARP cache reconstruction belongs in a session-tracker.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Result ¶
type Result struct {
HardwareType int `json:"hardware_type"`
HardwareTypeName string `json:"hardware_type_name"`
ProtocolType int `json:"protocol_type"`
ProtocolTypeHex string `json:"protocol_type_hex"`
ProtocolTypeName string `json:"protocol_type_name"`
HLEN int `json:"hardware_address_length"`
PLEN int `json:"protocol_address_length"`
Operation int `json:"operation"`
OperationName string `json:"operation_name"`
SenderHardware string `json:"sender_hardware_address"`
SenderProtocol string `json:"sender_protocol_address"`
TargetHardware string `json:"target_hardware_address"`
TargetProtocol string `json:"target_protocol_address"`
TotalBytes int `json:"total_bytes"`
Notes []string `json:"notes,omitempty"`
}
Result is the top-level decoded view.
Source Files