ARP Reply

Dec 7, 2011 at 11:00 AM

string sgatewayIP = "";
string sbroadcastIP = "";
string stargetMAC = "ff:ff:ff:ff:ff:ff";

            MacAddress tempMyMac = selectedDevice.GetMacAddress();
            MacAddress tempTargetMAC = new MacAddress(stargetMAC);
            IpV4Address tempBroadcastIP = new IpV4Address(sbroadcastIP);
            IpV4Address tempMyIP = new IpV4Address(sgatewayIP);

            byte[] targetMAC = new byte[6]; //MAC and IP for ARPLayer
            targetMAC.Write(0, tempTargetMAC, 0 /*0 = small endian*/);
            byte[] broadcastIP = new byte[4];
            broadcastIP.Write(0, tempBroadcastIP, 0);
            byte[] myMAC = new byte[6];
            myMAC.Write(0, tempMyMac, 0);
            byte[] myIP = new byte[4];
            myIP.Write(0, tempMyIP, 0);

EthernetLayer ethernetLayer = new EthernetLayer
                Source = tempMyMac,
                Destination = tempTargetMAC

            //ARP Layer
            ArpLayer arpLayer = new ArpLayer
                SenderHardwareAddress = new ReadOnlyCollection<byte>(myMAC), //specifying address parameters
                TargetHardwareAddress = new ReadOnlyCollection<byte>(targetMAC),
                SenderProtocolAddress = new ReadOnlyCollection<byte>(myIP),
                TargetProtocolAddress = new ReadOnlyCollection<byte>(broadcastIP),
                Operation = ArpOperation.Reply// ARP reply OP Code

PacketBuilder builder = new PacketBuilder(ethernetLayer, arpLayer);

            // Build the packet
            Packet packet = builder.Build(DateTime.Now);

            // Send down the packet




The code above is a part of my program which i find relevant for rectifying my problem. I checked in wireshark while running this and I got the packets which suggests that it is working. However, the ARP addresses information is incorrect.


1836    5.260416    D-Link_6b:a7:c8    Broadcast    ARP    0100a8c0 is at c8:a7:6b:68:7d:f0


This is a sample of wireshark capture. Here are the problems.

1. As seen above, "0100a8c0 is at c8:a7:6b:68:7d:f0" the address is reversed (big endian eventhough i have specified as little endian).

2. The address are in hexadecimal and not in the ASCII form like  "Broadcast    ARP is at f0:7d:68:6b:a7:c8".

Thank you.

Dec 10, 2011 at 9:11 AM

I believe you should use Big Endianity and not Small Endianity.

Dec 12, 2011 at 3:13 PM

Thank you.