Network layer-arp Protocol (03)

Address Resolution Protocol, or ARP (Address Resolution Protocol), is a TCP/IP protocol that obtains physical addresses based on IP addresses. When sending information, the host broadcasts the ARP request containing the target IP address to all hosts on the network, and receives the return message to determine the physical address of the target; after receiving the return message, the IP address and the physical address are stored in the local ARP cache and retained for a certain period of time, and the next request directly queries the ARP cache to save resources.

The address resolution protocol is based on the mutual trust of all hosts in the network, and the hosts on the network can send ARP reply messages on their own. when other hosts receive the reply message, they will record it in the local ARP cache if they do not detect the authenticity of the message. In this way, a person can send a pseudo ARP reply message to a host, so that the information it sends cannot reach the expected host or the wrong host.

The arp protocol written by netizen xpleaf, combined with the packet grabbing tool, is analyzed in detail according to the data packet:

Http://xpleaf.blog.51cto.com/9315560/1761856