arp request

Jan 4, 2011 at 12:19 PM

Hello Sir/Medam

i want  to generate arp request packet;

i did like the following

ArpLayer  arplayer;

arplayer.Operation = ArpOperation.Request;
                arplayer.ProtocolType = EthernetType.IpV4;
                arplayer.SenderHardwareAddress = new ReadOnlyCollection<byte>(macbytes);
                arplayer.SenderProtocolAddress = new ReadOnlyCollection<byte>(ipbytes);
                arplayer.TargetHardwareAddress = new ReadOnlyCollection<byte>(thbytes);
                arplayer.TargetProtocolAddress = new ReadOnlyCollection<byte>(targetipbytes);

but i could not find how assign


so what do you advice me

thanks in advance


Jan 4, 2011 at 4:33 PM

Hi wedinsa,


There is no DataLink property to ArpLayer.

Why do you need it?



Jan 5, 2011 at 7:33 AM
Edited Jan 5, 2011 at 8:08 AM

Hi  Boaz

when i tried to build  arp packet 

that means

PacketBuilder builder = PacketBuilder(arplayer)

the error created is :  ArgumentException unhandled

First layer (PcapDotNet.Packets.Arp.ArpLayer) must provide a DataLink
Parameter name: layers

i thought that the  DataLink parameter is necessary,  i would be happy to suggest me  from the error happened what i should do


Advice me  another method to build arp packet

 either to use arp layer or arpDatagram


Jan 5, 2011 at 11:23 AM

You need to use an EthernetLayer.

PacketBuilder.Build(DateTime.Now, ethernetLayer, arplayer);

Jan 5, 2011 at 1:06 PM

Am i going to fill all the properties

for ethernet layer?

if so

how could i assign values for  proprties?

give some hint on this  matter

Jan 5, 2011 at 6:51 PM

Yes, you need to fill the properties.

You need to know what packet you want and to assign the values accordingly.

Technically, you can look for some information at Pcap.Net User Guide -> Pcap.Net Tutorial - Sending Packets

Jan 10, 2011 at 5:23 AM

Hi Boaz

i did like what u said me

as follows

MacAddress destination = new MacAddress("ff:ff:ff:ff:ff:ff");

EthernetLayer ethernet = new EthernetLayer
                Destination = destination

 Packet packet = PacketBuilder.Build(DateTime.Now, ethernet, arplayer);

            using (communicator = selectedDevice.Open(65536, PacketDeviceOpenAttributes.Promiscuous, 1000))
                if (communicator.DataLink.Kind != DataLinkKind.Ethernet)
                    Console.WriteLine("this works in ethernet ");



by looking at this what do you advice me to get the hardware address

is it necessary to create another arp layer with operation  reply or  there is another method?



Jan 10, 2011 at 5:54 PM

Each packet should have it's own layers and you should create the necessary layers for each packet.

You can reuse the same layer instance for different packets by changing only some of the fields for each packet.


I'm not sure what you're trying to achieve so I can't tell you where to take the hardware address from...

Jan 11, 2011 at 4:42 AM
Edited Jan 12, 2011 at 11:53 AM


the thing which i want to achieve is

first get mac address of the remote pc using arp request packet then

sending packets to the target pc

i am sending the packet

but my problem is  how to access the reply

and print out the  hardware address of the pc



Jan 11, 2011 at 4:13 PM

If you send the right ARP over Ethernet packet at first (the query - to broadcast), look at the reply in Wireshark and receive it using another communicator.

Jan 12, 2011 at 9:59 AM

the result of the request from the wireshark

protocol type  = ip

hardware size =  17

protocol size = 10

and the addresses are not in the string format which can be readable

and there is no response

sorry for my silly questions but  i need ur help

how to give value  to the properties of arplayer

Please give me a sample  how to give value



Jan 12, 2011 at 8:57 PM

Can you write the code you've tried so I'll try to find out what's wrong.

Also can you upload the pcap file somewhere so I can look at the packet you've created?



Jan 13, 2011 at 5:36 AM

using System;
using System.Collections.Generic;
using System.Collections.ObjectModel;
using System.Linq;
using System.Text;
using System.Net;
using PcapDotNet.Core;
using PcapDotNet.Base;
using System.Globalization;
using PcapDotNet.Core.Extensions;
using PcapDotNet.Packets;
using PcapDotNet.Packets.Ethernet;
using PcapDotNet.Packets.Arp;
using PcapDotNet.Packets.IpV4;


 PcapDotNet.Analysis.PcapDotNetAnalysis.OptIn = true;
            IList<LivePacketDevice> alldevices = LivePacketDevice.AllLocalMachine;
            PacketCommunicator communicator;


Console.WriteLine("Enter target Address");
            string targetaddress = Console.ReadLine();
            string mac = selectedDevice.GetMacAddress().ToString();
            string tha = "00:00:00:00:00:00";
            ASCIIEncoding encoding = new ASCIIEncoding();
            byte[] macbytes = encoding.GetBytes(mac);
            ASCIIEncoding encoding1 = new ASCIIEncoding();

            string myHost = Dns.GetHostName();
            string myip = Dns.GetHostEntry(myHost).AddressList[0].ToString();
            byte[] ipbytes = encoding1.GetBytes(myip);
            ASCIIEncoding encoding3 = new ASCIIEncoding();
            byte[] thbytes = encoding3.GetBytes(tha);
            ASCIIEncoding encoding2 = new ASCIIEncoding();
            byte[] targetipbytes = encoding2.GetBytes(targetaddress);
            MacAddress destination = new MacAddress("ff:ff:ff:ff:ff:ff");
            MacAddress source = selectedDevice.GetMacAddress();
            EthernetType ethertype = EthernetType.Arp;

            using (communicator = selectedDevice.Open(65536, PacketDeviceOpenAttributes.Promiscuous, 1000))
                EthernetLayer ethernet = new EthernetLayer

                    Source = source,
                    Destination = destination,
                    EtherType = ethertype
                ArpLayer arplayer = new ArpLayer
                    ProtocolType = EthernetType.IpV4,
                    Operation = ArpOperation.Request,
                    SenderHardwareAddress = new ReadOnlyCollection<byte>(macbytes),
                    SenderProtocolAddress = new ReadOnlyCollection<byte>(ipbytes),
                    TargetHardwareAddress = new ReadOnlyCollection<byte>(thbytes),
                    TargetProtocolAddress = new ReadOnlyCollection<byte>(targetipbytes)


                Packet packet = PacketBuilder.Build(DateTime.Now, ethernet, arplayer);


this is the request i did develop

Jan 17, 2011 at 5:25 AM
Edited Jan 21, 2011 at 5:04 AM

Hi Boaz

I am waiting your Help

if it is not clear help me the following;

i got my sender mac address using 


i converted it to byte using ASciiencoding.getbyte() the converted one is macbytes;


i did the following

SendHardwareAddress = new ReadOnlyCollection<byte>(macbytes);

but As you can see from the previous post, the value is not correct so help me


the following ReadOnly Collection type how to assign

and how to create List


public ReadOnlyCollection<byte> SenderHardwareAddress { get; set; } 
Jan 21, 2011 at 9:00 AM

Hi wedinsa,


Don't use ASCII to convert to bytes to put as the ARP addresses.

The addresses in ARP are not strings in ASCII.

IPv4 address should be 4 bytes as ARP address.

MAC address should be 6 bytes as ARP address.

Try and use Pcap.Net's IpV4Address and MacAddress classes to do the conversions instead of ASCII.


MacAddress macAddress...

byte[] buffer = new byte[6];

buffer.Write(0, macAddress, endianity);


IpV4Address ipV4Address...

byte[] buffer = new byte[4];

buffer.Write(0, ipV4Address, endianity);


By the way, when you do use ASCII encoding, use Encoding.ASCII static property instead of create an Encoding instance, it makes the code more readable.



Jan 24, 2011 at 11:35 AM

Hi Boaz

for the request it works exactly.

and i saw  its reply

and it gives me the exact mac address

for the reply

i tried like the following

i opened another communicator

and i just created another packet

using (PacketCommunicator communicator 1= selectedDevice.Open())


 Packet packet1;

 PacketCommunicatorReceiveResult result = communicator1.ReceivePacket(out packet1)

if(result == PacketCommunicatorReceiveResult.Ok)


ArpLayer  arplayer1 = (ArpLayer)packet1.Ethernet.Arp.ExtractLayer();

if(arplayer1.Operation = ArpOperation.Reply)


         string mac1 = arplayer1.SenderHardwareAddress.ToString();




but it does not print it out to console

so what could be my mistake  Sir?


Jan 26, 2011 at 2:16 PM

You might receive a result different than Ok.

Try and see what result you get and why do you get it.



Jan 28, 2011 at 10:23 AM

Hi Boaz

i tried to look at the process  and it is not   Ok  but it is timeout

this is because of no incoming packet which arp

so what do you advice me

shall include inside of the first opened communicator or  out side of it

i sometimes get   arp.Operation = request

but not Reply

So please I need ur Help

thanks for  every favor you did for me



Jan 28, 2011 at 4:03 PM

Hi wedinsa,


It seems you only try to receive one packet once and only for 1 second.

I believe that's why you miss the packets.

You can try doing that in a loop or use the other packets receiving methods like ReceivePackets().



Feb 1, 2011 at 7:24 AM

Hi Boaz

i did what  you adviced me



private static void PacketHandler(Packet packet1)
            EthernetLayer ethernet = (EthernetLayer)packet1.Ethernet.ExtractLayer();
            bool condition = false;
            if (ethernet.EtherType == EthernetType.Arp)
                Console.WriteLine("This is Arp Packet!!!");
                ArpLayer arp1 = (ArpLayer)packet1.Ethernet.Arp.ExtractLayer();
                IpV4Layer ipv4 = (IpV4Layer)packet1.Ethernet.IpV4.ExtractLayer();
                if (ipv4.Source == new IpV4Address(destip))
                    condition = true;
                if (arp1.Operation == ArpOperation.Reply && condition == true)
                    string SourceMac = ethernet.Source.ToString();
                    Console.WriteLine("soucemac:" + SourceMac);

i am getting arp packets but still i could not get my own reply packet

suggest me  please


Feb 1, 2011 at 12:09 PM

Hi wenddissa try to have the wireshark active while you try to recive the reply so you can see if the wireshark recives it too

Feb 1, 2011 at 12:47 PM

Hi Adum 264

i can see it in wireshark

it is working

there is a perfect reply


Feb 4, 2011 at 8:19 PM

Try to remove the filter and get the packet in Pcap.Net.

Try to add the ARP filter to Wireshark BPF and see if you get it.

Feb 11, 2011 at 5:30 AM

Hi Boaz

I solved the problem thanks for YOUR Help

i need to now

in  the middle of sending i need  to stop sending packets

How can i do that?

thanks for YOUR Help in advance.

Feb 11, 2011 at 1:07 PM

Hi wedinsa,


What do you mean "in the middle of sending"?

You can decide for each packet whether you want to send it or not.



Feb 17, 2011 at 5:23 AM

Hi Boaz

How can i stop  from sending packets

 which method should i use so that i can decide to not send?

Feb 18, 2011 at 3:41 PM

Hi wedinsa,


Just don't call the method that sends the packets.

If the packets are not sent using Pcap.Net, you can't stop them using Pcap.Net.