ARP/RARP报文协议格式
ARP（Address Resolution Protocol，地址解析协议）是用来将IP地址解析为MAC地址的协议。RARP（Reverse Address Resolution Protocol，反向地址解析协议）是用来将MAC地址解析为IP地址的协议。
一、ARP/RARP报文格式
+0--------------7--------------15----------------23----------------31
| Ethernet Address of Destination(0-47) |
+ +--------------------------------|
| | |
+----------------------------------+ |
| Ethernet Address of Sender(0-47) |
+----------------------------------|--------------------------------|
| Frame Type | Hardware Type |
+----------------------------------|----------------|---------------|
| Protocol Type | Hardware Length|Protocol Length|
+----------------------------------|--------------------------------|
| OP | |
+----------------------------------+ |
| Ethernet Address of Sender(0-47) |
+-------------------------------------------------------------------|
| IP Address of Sender |
+-------------------------------------------------------------------|
| Ethernet Address of Destination(0-47) |
+ +--------------------------------|
| | IP Address of Destination(0-15)|
+----------------------------------|--------------------------------|
| IP Address of Destination(16-31) |
+----------------------------------|二、ARP/RARP报文格式释义
|
字段 |
长度（bit） |
含义 |
|---|---|---|
|
Ethernet Address of Destination |
48比特 |
目的MAC地址。发送ARP请求时，为广播的MAC地址，0xFFFF-FFFF-FFFF。 |
|
Ethernet Address of Sender |
48比特 |
源MAC地址。 |
|
Frame Type |
16比特 |
表示后面数据的类型。对于ARP请求或应答来说，该字段的值为0x0806。 |
|
Hardware Type |
16比特 |
表示硬件地址的类型。对于以太网，该类型的值为“1”。 |
|
Protocol Type |
16比特 |
表示发送方要映射的协议地址类型。对于IP地址，该值为0x0800。 |
|
Hardware Length |
8比特 |
表示硬件地址的长度，单位是字节。对于ARP请求或应答来说，该值为6。 |
|
Protocol Length |
8比特 |
表示协议地址的长度，单位是字节。对于ARP请求或应答来说，该值为4。 |
|
OP |
16比特 |
操作类型:
|
|
Ethernet Address of Sender |
48比特 |
发送方以太网地址。这个字段和ARP报文首部的源以太网地址字段是重复信息。 |
|
IP Address of Sender |
32比特 |
发送方的IP地址。 |
|
Ethernet Address of Destination |
48比特 |
接收方的以太网地址。发送ARP请求时，该处填充值为0x00.00.00.00.00.00。 |
|
IP Address of Destination |
32比特 |
接收方的IP地址。 |
三、免费ARP请求报文（源IP地址和目的IP地址相同）示例
Frame 1: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
Arrival Time: Mar 17, 2015 14:04:47.300357000
Epoch Time: 1426572287.300357000 seconds
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 60 bytes (480 bits)
Capture Length: 60 bytes (480 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:arp]
[Coloring Rule Name: ARP]
[Coloring Rule String: arp]
Ethernet II, Src: PaloAlto_00:01:1a (00:1b:17:00:01:1a), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Destination: Broadcast (ff:ff:ff:ff:ff:ff)
Address: Broadcast (ff:ff:ff:ff:ff:ff)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
.... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
Source: PaloAlto_00:01:1a (00:1b:17:00:01:1a)
Address: PaloAlto_00:01:1a (00:1b:17:00:01:1a)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
Type: ARP (0x0806)
Trailer: 110200000000000000000000ffff00000000
Address Resolution Protocol (request/gratuitous ARP)
Hardware type: Ethernet (1)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: request (1)
[Is gratuitous: True]
Sender MAC address: PaloAlto_00:01:1a (00:1b:17:00:01:1a)
Sender IP address: 172.30.129.254 (172.30.129.254)
Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
Target IP address: 172.30.129.254 (172.30.129.254)四、 ARP请求报文示例
Frame 1: 42 bytes on wire (336 bits), 42 bytes captured (336 bits)
Arrival Time: Dec 2, 2014 11:13:48.003989000
Epoch Time: 1417490028.003989000 seconds
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 42 bytes (336 bits)
Capture Length: 42 bytes (336 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:arp]
[Coloring Rule Name: ARP]
[Coloring Rule String: arp]
Ethernet II, Src: 00:ac:27:96:47:87 (00:ac:27:96:47:87), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Destination: Broadcast (ff:ff:ff:ff:ff:ff)
Address: Broadcast (ff:ff:ff:ff:ff:ff)
.... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
Source: 00:ac:27:96:47:87 (00:ac:27:96:47:87)
Address: 00:ac:27:96:47:87 (00:ac:27:96:47:87)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: ARP (0x0806)
Address Resolution Protocol (request)
Hardware type: Ethernet (1)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: request (1)
[Is gratuitous: False]
Sender MAC address: 00:ac:27:96:47:87 (00:ac:27:96:47:87)
Sender IP address: 10.60.23.77 (10.60.23.77)
Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
Target IP address: 10.60.254.254 (10.60.254.254)五、ARP应答报文示例
Frame 1: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
Arrival Time: Dec 2, 2014 11:13:48.017405000
Epoch Time: 1417490028.017405000 seconds
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 60 bytes (480 bits)
Capture Length: 60 bytes (480 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:arp]
[Coloring Rule Name: ARP]
[Coloring Rule String: arp]
Ethernet II, Src: 04:f9:38:d7:d4:a1 (04:f9:38:d7:d4:a1), Dst: 00:ac:27:96:47:87 (00:ac:27:96:47:87)
Destination: 00:ac:27:96:47:87 (00:ac:27:96:47:87)
Address: 00:ac:27:96:47:87 (00:ac:27:96:47:87)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: 04:f9:38:d7:d4:a1 (04:f9:38:d7:d4:a1)
Address: 04:f9:38:d7:d4:a1 (04:f9:38:d7:d4:a1)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: ARP (0x0806)
Trailer: 000000000000000000000000000000000000
Address Resolution Protocol (reply)
Hardware type: Ethernet (1)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: reply (2)
[Is gratuitous: False]
Sender MAC address: 04:f9:38:d7:d4:a1 (04:f9:38:d7:d4:a1)
Sender IP address: 10.60.254.254 (10.60.254.254)
Target MAC address: 00:ac:27:96:47:87 (00:ac:27:96:47:87)
Target IP address: 10.60.23.77 (10.60.23.77)六、RARP请求报文示例
Frame 1: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
Arrival Time: Jun 11, 2006 18:41:54.346457000
Epoch Time: 1150022514.346457000 seconds
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 60 bytes (480 bits)
Capture Length: 60 bytes (480 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:arp]
[Coloring Rule Name: ARP]
[Coloring Rule String: arp]
Ethernet II, Src: Marquett_12:dd:88 (00:00:a1:12:dd:88), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Destination: Broadcast (ff:ff:ff:ff:ff:ff)
Address: Broadcast (ff:ff:ff:ff:ff:ff)
.... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
Source: Marquett_12:dd:88 (00:00:a1:12:dd:88)
Address: Marquett_12:dd:88 (00:00:a1:12:dd:88)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: RARP (0x8035)
Trailer: 000000000000000000000000000000000000
Address Resolution Protocol (reverse request)
Hardware type: Ethernet (1)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: reverse request (3)
[Is gratuitous: False]
Sender MAC address: Marquett_12:dd:88 (00:00:a1:12:dd:88)
Sender IP address: 0.0.0.0 (0.0.0.0)
Target MAC address: Marquett_12:dd:88 (00:00:a1:12:dd:88)
Target IP address: 0.0.0.0 (0.0.0.0)七、RARP应答报文示例
Frame 2: 42 bytes on wire (336 bits), 42 bytes captured (336 bits)
Arrival Time: Dec 5, 2013 23:59:59.432926000
Epoch Time: 1386259199.432926000 seconds
[Time delta from previous captured frame: 0.002000000 seconds]
[Time delta from previous displayed frame: 0.002000000 seconds]
[Time since reference or first frame: 0.002000000 seconds]
Frame Number: 2
Frame Length: 42 bytes (336 bits)
Capture Length: 42 bytes (336 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:arp]
[Coloring Rule Name: ARP]
[Coloring Rule String: arp]
Ethernet II, Src: Vmware_c5:f6:9b (00:0c:29:c5:f6:9b), Dst: Vmware_34:0b:de (00:0c:29:34:0b:de)
Destination: Vmware_34:0b:de (00:0c:29:34:0b:de)
Address: Vmware_34:0b:de (00:0c:29:34:0b:de)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: Vmware_c5:f6:9b (00:0c:29:c5:f6:9b)
Address: Vmware_c5:f6:9b (00:0c:29:c5:f6:9b)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: RARP (0x8035)
Address Resolution Protocol (reverse reply)
Hardware type: Ethernet (1)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: reverse reply (4)
[Is gratuitous: False]
Sender MAC address: Vmware_c5:f6:9b (00:0c:29:c5:f6:9b)
Sender IP address: 10.1.1.10 (10.1.1.10)
Target MAC address: Vmware_34:0b:de (00:0c:29:34:0b:de)
Target IP address: 10.1.1.100 (10.1.1.100)
发表评论