This project is read-only.

ARP Filter

Sep 18, 2013 at 5:17 PM
Edited Sep 18, 2013 at 5:22 PM
Hello! I'm new to Pcap.Net and I am trying to build an ARP filter.

For a UDP packet, I got this from the example code. How would I modify it for ARP Packets?
IpV4Datagram ip = packet.Ethernet.IpV4;
UdpDatagram udp = ip.Udp;
I've successfully configured an ARP filter, and tried the following in my packet handler.
        // Callback function invoked by Pcap.Net for every incoming packet
        private static void PacketHandler(Packet packet)
        {
            Console.WriteLine(packet.Timestamp.ToString("yyyy-MM-dd hh:mm:ss.fff") + " length:" + packet.Length);

            ArpDatagram ArpPacket = packet.Ethernet.Arp;

            Console.Out.WriteLine("ARP Sender: " + ArpPacket.SenderHardwareAddress);
      
        }
Which, when executed, produces this:

"ARP Sender: System.Collections.ObjectModel.ReadOnlyCollection'1[System.Byte]"

What am I doing wrong?


Thank You So Much!
Sep 18, 2013 at 5:47 PM
I've Solved my own issue!

SenderHardwareAddress is an indexed data type.

So, here is my new packet handler.
        private static void PacketHandler(Packet packet)
        {
            //Console.WriteLine(packet.Timestamp.ToString("yyyy-MM-dd hh:mm:ss.fff") + " length:" + packet.Length);

            ArpDatagram ArpPacket = packet.Ethernet.Arp;

            ArpPacket.Operation.ToString();

            Console.Out.WriteLine("ARP Type: " + ArpPacket.Operation.ToString());

            Console.Write("Sender MAC: ");
            for (int i = 0; i < 6; i++)
            {
                if(i<5)
                    Console.Out.Write("{0:X}:", ArpPacket.SenderHardwareAddress[i]);
                else
                    Console.Out.Write("{0:X}", ArpPacket.SenderHardwareAddress[i]);

            }
            Console.WriteLine();
        }