Decoding ARP headers

In the Decoding Ethernet headers recipe, we created the got_packet() callback function that libpcap called for each packet that was captured. In this function, we learned how to pull out the Ethernet header information from the packet and created a switch statement that switched on the protocol type. In that switch statement, we made a reference to the decodeArp() function that is used to decode the ARP headers. In this recipe, we will create that decodeArp() function.

The ARP header is a part of the second layer (Internet layer) of our header stack. Its structure is shown in the following diagram:

Let's take a look at the fields of the ARP header:

• Hardware Type: This specifies the network protocol type. Some of the defined values are:

  • 1 – Ethernet

  • 6 – IEEE 802 network

  • 7 – ARCNET

  • 15 – Frame Relay

  • 18 – Fibre Channel

  • 20 – Serial Line

• Protocol Type: This specifies the internetworking protocol type. Some of the defined values are:

  • 0x0800 – IPv4

  • 0x0806 – ARP

  • 0x8035 – RARP

  • 0x86DD – IPv6...