![image-20241110210209022](./assets/image-20241110210209022.png) ``` root@pc1:~# tcpdump -i eth1 tcpdump: verbose output suppressed, use -v[v]... for full protocol decode listening on eth1, link-type EN10MB (Ethernet), snapshot length 262144 bytes 19:35:04.553056 IP6 fe80::216:3eff:fe00:2 > fe80::216:3eff:fe00:4: ICMP6, echo request, id 38058, seq 1, length 64 19:35:04.555038 IP6 fe80::216:3eff:fe00:4 > fe80::216:3eff:fe00:2: ICMP6, echo reply, id 38058, seq 1, length 64 19:35:05.554500 IP6 fe80::216:3eff:fe00:2 > fe80::216:3eff:fe00:4: ICMP6, echo request, id 38058, seq 2, length 64 19:35:05.555265 IP6 fe80::216:3eff:fe00:4 > fe80::216:3eff:fe00:2: ICMP6, echo reply, id 38058, seq 2, length 64 19:35:06.555772 IP6 fe80::216:3eff:fe00:2 > fe80::216:3eff:fe00:4: ICMP6, echo request, id 38058, seq 3, length 64 19:35:06.556673 IP6 fe80::216:3eff:fe00:4 > fe80::216:3eff:fe00:2: ICMP6, echo reply, id 38058, seq 3, length 64 19:35:07.557110 IP6 fe80::216:3eff:fe00:2 > fe80::216:3eff:fe00:4: ICMP6, echo request, id 38058, seq 4, length 64 19:35:07.557961 IP6 fe80::216:3eff:fe00:4 > fe80::216:3eff:fe00:2: ICMP6, echo reply, id 38058, seq 4, length 64 19:35:08.558528 IP6 fe80::216:3eff:fe00:2 > fe80::216:3eff:fe00:4: ICMP6, echo request, id 38058, seq 5, length 64 19:35:08.559256 IP6 fe80::216:3eff:fe00:4 > fe80::216:3eff:fe00:2: ICMP6, echo reply, id 38058, seq 5, length 64 19:35:08.722292 IP6 fe80::216:3eff:fe00:4 > fe80::216:3eff:fe00:2: ICMP6, echo request, id 10952, seq 1, length 64 19:35:08.722331 IP6 fe80::216:3eff:fe00:2 > fe80::216:3eff:fe00:4: ICMP6, echo reply, id 10952, seq 1, length 64 19:35:09.631016 IP6 fe80::216:3eff:fe00:4 > fe80::216:3eff:fe00:2: ICMP6, neighbor solicitation, who has fe80::216:3eff:fe00:2, length 32 19:35:09.631064 IP6 fe80::216:3eff:fe00:2 > fe80::216:3eff:fe00:4: ICMP6, neighbor advertisement, tgt is fe80::216:3eff:fe00:2, length 24 19:35:09.723566 IP6 fe80::216:3eff:fe00:4 > fe80::216:3eff:fe00:2: ICMP6, echo request, id 10952, seq 2, length 64 19:35:09.723596 IP6 fe80::216:3eff:fe00:2 > fe80::216:3eff:fe00:4: ICMP6, echo reply, id 10952, seq 2, length 64 19:35:10.724802 IP6 fe80::216:3eff:fe00:4 > fe80::216:3eff:fe00:2: ICMP6, echo request, id 10952, seq 3, length 64 19:35:10.724838 IP6 fe80::216:3eff:fe00:2 > fe80::216:3eff:fe00:4: ICMP6, echo reply, id 10952, seq 3, length 64 19:35:11.726031 IP6 fe80::216:3eff:fe00:4 > fe80::216:3eff:fe00:2: ICMP6, echo request, id 10952, seq 4, length 64 19:35:11.726064 IP6 fe80::216:3eff:fe00:2 > fe80::216:3eff:fe00:4: ICMP6, echo reply, id 10952, seq 4, length 64 19:35:12.727250 IP6 fe80::216:3eff:fe00:4 > fe80::216:3eff:fe00:2: ICMP6, echo request, id 10952, seq 5, length 64 19:35:12.727282 IP6 fe80::216:3eff:fe00:2 > fe80::216:3eff:fe00:4: ICMP6, echo reply, id 10952, seq 5, length 64 ``` ``` root@pc1:~# python3 208.py Ether / fe80::216:3eff:fe00:2 > ff02::16 (0) / IPv6ExtHdrHopByHop / ICMPv6MLReport2 Ether / fe80::216:3eff:fe00:2 > ff02::16 (0) / IPv6ExtHdrHopByHop / ICMPv6MLReport2 Ether / fe80::216:3eff:fe00:4 > ff02::16 (0) / IPv6ExtHdrHopByHop / ICMPv6MLReport2 Ether / fe80::216:3eff:fe00:4 > ff02::16 (0) / IPv6ExtHdrHopByHop / ICMPv6MLReport2 Ether / IPv6 / ICMPv6 Echo Request (id: 0x3d3d seq: 0x1) Ether / IPv6 / ICMPv6 Echo Reply (id: 0x3d3d seq: 0x1) Ether / IPv6 / ICMPv6 Echo Request (id: 0x3d3d seq: 0x2) Ether / IPv6 / ICMPv6 Echo Reply (id: 0x3d3d seq: 0x2) Ether / IPv6 / ICMPv6 Echo Request (id: 0x3d3d seq: 0x3) Ether / IPv6 / ICMPv6 Echo Reply (id: 0x3d3d seq: 0x3) Ether / IPv6 / ICMPv6 Echo Request (id: 0x3d3d seq: 0x4) Ether / IPv6 / ICMPv6 Echo Reply (id: 0x3d3d seq: 0x4) Ether / IPv6 / ICMPv6 Echo Request (id: 0x3d3d seq: 0x5) Ether / IPv6 / ICMPv6 Echo Reply (id: 0x3d3d seq: 0x5) Ether / IPv6 / ICMPv6 Echo Request (id: 0x6b18 seq: 0x1) Ether / IPv6 / ICMPv6 Echo Reply (id: 0x6b18 seq: 0x1) Ether / IPv6 / ICMPv6 Echo Request (id: 0x6b18 seq: 0x2) Ether / IPv6 / ICMPv6 Echo Reply (id: 0x6b18 seq: 0x2) Ether / IPv6 / ICMPv6 Echo Request (id: 0x6b18 seq: 0x3) Ether / IPv6 / ICMPv6 Echo Reply (id: 0x6b18 seq: 0x3) Ether / IPv6 / ICMPv6 Echo Request (id: 0x6b18 seq: 0x4) Ether / IPv6 / ICMPv6 Echo Reply (id: 0x6b18 seq: 0x4) Ether / IPv6 / ICMPv6 Echo Request (id: 0x6b18 seq: 0x5) Ether / IPv6 / ICMPv6 Echo Reply (id: 0x6b18 seq: 0x5) ``` ![image-20241114215255732](https://lsky.mhrooz.xyz/2024/11/14/876adec1dda00.png) ![image-20241114221022240](./assets/image-20241114221022240.png) ![image-20241120144256948](./assets/image-20241120144256948.png) ``` buf :255 255 255 255 255 255 174 171 50 9 142 180 8 6 0 1 8 0 6 4 0 1 174 171 50 9 142 180 10 5 1 1 0 0 0 0 0 0 10 5 1 2 0 0 0 0 0 0 0 0 0 0 0 22 58 0 5 2 0 0 1 0 143 0 117 226 0 0 0 1 4 0 0 0 255 2 0 0 0 0 0 0 0 0 0 1 255 9 142 180 0 0 0 0 0 0 0 0 0 0 0 0 0 0 156 111 139 231 79 127 0 0 95 154 127 103 0 0 0 0 1 0 0 0 0 0 0 0 228 77 109 231 79 127 0 0 240 212 138 231 79 127 0 0 9 0 0 0 0 0 0 0 164 115 139 231 79 127 0 0 196 0 0 0 0 0 0 0 16 78 110 231 79 127 0 0 0 112 138 231 79 127 0 0 216 182 6 248 254 127 0 0 212 182 6 248 254 127 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 16 78 110 231 79 127 0 0 224 111 109 231 79 127 0 0 49 217 138 231 79 127 0 0 95 154 127 103 0 0 0 0 105 254 157 1 0 0 0 0 212 182 6 248 254 127 0 0 32 117 138 231 79 127 0 0 160 183 6 248 254 127 0 0 240 212 138 231 79 127 0 0 144 183 6 248 254 127 0 0 3 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 95 154 127 103 0 0 0 0 232 148 141 231 79 127 0 0 49 217 138 231 79 127 0 0 184 184 6 248 254 127 0 0 144 183 6 248 254 127 0 0 160 183 6 248 254 127 0 0 225 124 139 231 79 127 0 0 1 0 0 0 0 0 0 0 168 121 138 231 79 127 0 0 9 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 232 137 141 231 79 127 0 0 48 151 141 231 79 127 0 0 168 121 138 231 79 127 0 0 232 137 141 231 79 127 0 0 0 0 0 0 1 0 0 0 232 148 141 231 79 127 0 0 0 0 0 0 0 0 0 0 216 210 10 248 254 127 0 0 184 209 10 248 254 127 0 0 255 255 255 255 0 0 0 0 83 143 48 104 0 0 0 0 64 130 109 231 79 127 0 0 0 112 138 231 79 127 0 0 88 151 141 231 79 127 0 0 176 184 6 248 254 127 0 0 192 185 6 248 254 127 0 0 3 0 0 0 0 0 0 0 208 184 6 248 254 127 0 0 100 223 139 231 79 127 0 0 217 118 141 231 79 127 0 0 80 223 138 231 79 127 0 0 48 185 6 248 254 127 0 0 7 0 0 0 0 0 0 0 7 0 0 0 8 0 0 0 240 212 138 231 79 127 0 0 232 137 141 231 79 127 0 0 77 146 139 231 79 127 0 0 0 0 0 0 0 0 0 0 216 160 139 231 79 127 0 0 128 184 6 248 254 127 0 0 200 197 110 231 79 127 0 0 8 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 185 6 248 254 127 0 0 0 0 0 0 0 0 0 0 0 185 6 248 254 127 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 96 215 138 231 79 127 0 0 232 148 141 231 79 127 0 0 132 217 138 231 79 127 0 0 48 212 138 231 79 127 0 0 72 128 141 231 79 127 0 0 0 208 138 231 79 127 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 64 130 109 231 79 127 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 186 183 144 108 127 166 0 0 3 232 138 108 127 166 0 0 128 145 141 231 79 127 0 0 128 145 141 231 79 127 0 0 232 70 140 231 79 127 0 0 208 187 6 248 254 127 0 0 31 27 139 231 79 127 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 64 133 138 231 79 127 0 0 128 144 141 231 79 127 0 0 0 0 0 0 0 0 0 0 1 189 6 248 254 127 0 0 1 151 141 231 79 127 0 0 232 137 141 231 79 127 0 0 184 185 6 248 254 127 0 0 3 232 138 108 127 166 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 24 210 10 248 254 127 0 0 0 0 0 0 32 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 246 117 174 3 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 230 207 6 248 254 127 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 194 0 0 0 0 0 0 0 215 187 6 248 254 127 0 0 149 84 245 242 222 85 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Read 42 bytes from device tap0 ``` ``` buf :FF FF FF FF FF FF AE AB 32 09 8E B4 08 06 00 01 08 00 06 04 00 01 AE AB 32 09 8E B4 0A 05 01 01 00 00 00 00 00 00 0A 05 01 02 00 00 00 00 00 00 00 00 00 00 00 16 3A 00 05 02 00 00 01 00 8F 00 75 E2 00 00 00 01 04 00 00 00 FF 02 00 00 00 00 00 00 00 00 00 01 FF 09 8E B4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9C CF 46 E5 67 7F 00 00 5F 9A 7F 67 00 00 00 00 01 00 00 00 00 00 00 00 E4 AD 28 E5 67 7F 00 00 F0 34 46 E5 67 7F 00 00 09 00 00 00 00 00 00 00 A4 D3 46 E5 67 7F 00 00 C4 00 00 00 00 00 00 00 10 AE 29 E5 67 7F 00 00 00 D0 45 E5 67 7F 00 00 88 E3 64 9A FE 7F 00 00 84 E3 64 9A FE 7F 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 AE 29 E5 67 7F 00 00 E0 CF 28 E5 67 7F 00 00 31 39 46 E5 67 7F 00 00 5F 9A 7F 67 00 00 00 00 69 FE 9D 01 00 00 00 00 84 E3 64 9A FE 7F 00 00 20 D5 45 E5 67 7F 00 00 50 E4 64 9A FE 7F 00 00 F0 34 46 E5 67 7F 00 00 40 E4 64 9A FE 7F 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5F 9A 7F 67 00 00 00 00 E8 F4 48 E5 67 7F 00 00 31 39 46 E5 67 7F 00 00 68 E5 64 9A FE 7F 00 00 40 E4 64 9A FE 7F 00 00 50 E4 64 9A FE 7F 00 00 E1 DC 46 E5 67 7F 00 00 01 00 00 00 00 00 00 00 A8 D9 45 E5 67 7F 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 E8 E9 48 E5 67 7F 00 00 30 F7 48 E5 67 7F 00 00 A8 D9 45 E5 67 7F 00 00 E8 E9 48 E5 67 7F 00 00 00 00 00 00 01 00 00 00 E8 F4 48 E5 67 7F 00 00 00 00 00 00 00 00 00 00 D8 52 6F 9A FE 7F 00 00 B8 51 6F 9A FE 7F 00 00 FF FF FF FF 00 00 00 00 53 8F 30 68 00 00 00 00 40 E2 28 E5 67 7F 00 00 00 D0 45 E5 67 7F 00 00 58 F7 48 E5 67 7F 00 00 60 E5 64 9A FE 7F 00 00 70 E6 64 9A FE 7F 00 00 03 00 00 00 00 00 00 00 80 E5 64 9A FE 7F 00 00 64 3F 47 E5 67 7F 00 00 D9 D6 48 E5 67 7F 00 00 50 3F 46 E5 67 7F 00 00 E0 E5 64 9A FE 7F 00 00 07 00 00 00 00 00 00 00 07 00 00 00 08 00 00 00 F0 34 46 E5 67 7F 00 00 E8 E9 48 E5 67 7F 00 00 4D F2 46 E5 67 7F 00 00 00 00 00 00 00 00 00 00 D8 00 47 E5 67 7F 00 00 30 E5 64 9A FE 7F 00 00 C8 25 2A E5 67 7F 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B0 E5 64 9A FE 7F 00 00 00 00 00 00 00 00 00 00 B0 E5 64 9A FE 7F 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 37 46 E5 67 7F 00 00 E8 F4 48 E5 67 7F 00 00 84 39 46 E5 67 7F 00 00 30 34 46 E5 67 7F 00 00 48 E0 48 E5 67 7F 00 00 00 30 46 E5 67 7F 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 40 E2 28 E5 67 7F 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 33 C8 BC BE A7 00 00 3F 90 B0 BC BE A7 00 00 80 F1 48 E5 67 7F 00 00 80 F1 48 E5 67 7F 00 00 E8 A6 47 E5 67 7F 00 00 80 E8 64 9A FE 7F 00 00 1F 7B 46 E5 67 7F 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 E5 45 E5 67 7F 00 00 80 F0 48 E5 67 7F 00 00 00 00 00 00 00 00 00 00 01 EA 64 9A FE 7F 00 00 01 F7 48 E5 67 7F 00 00 E8 E9 48 E5 67 7F 00 00 68 E6 64 9A FE 7F 00 00 3F 90 B0 BC BE A7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 52 6F 9A FE 7F 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 F6 75 AE 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E6 EF 64 9A FE 7F 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C2 00 00 00 00 00 00 00 87 E8 64 9A FE 7F 00 00 F5 64 7B 22 E1 55 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Read 42 bytes from device tap0 ``` ``` buf :FF FF FF FF FF FF AE AB 32 09 8E B4 08 06 00 01 08 00 06 04 00 01 AE AB 32 09 8E B4 0A 05 01 01 00 00 00 00 00 00 0A 05 01 02 Read 42 bytes from device tap0 ``` ``` buf :FF FF FF FF FF FF AE AB 32 09 8E B4 08 06 00 01 08 00 06 04 00 01 AE AB 32 09 8E B4 0A 05 01 01 00 00 00 00 00 00 0A 05 01 03 Read 42 bytes from device tap0 ``` 00:16:3e:00:00:04 52:5e:a1:8f:e3:6a 根据提供的 `buf` 内容，可以解析出这是一个 **ARP 请求包**。以下是详细的解析步骤。 --- ### **1. ARP 数据包结构** ARP 请求包的基本结构如下： | 字段名称 | 长度（字节） | 说明 | | --------------------- | ------------ | ---------------------------------------------- | | 目标 MAC 地址 | 6 | 广播地址（`FF:FF:FF:FF:FF:FF`） | | 源 MAC 地址 | 6 | 发送方的 MAC 地址 | | 上层协议类型 | 2 | 表示这是一个 ARP 包（值为 `0x0806`） | | 硬件类型 | 2 | 通常为以太网（值为 `0x0001`） | | 协议类型 | 2 | 表示 IP 协议（值为 `0x0800`） | | 硬件地址长度 | 1 | MAC 地址的长度，通常为 6 | | 协议地址长度 | 1 | IP 地址的长度，通常为 4 | | 操作码 | 2 | `0x0001` 表示 ARP 请求，`0x0002` 表示 ARP 响应 | | 发送方硬件地址（SHA） | HLEN（6） | 发送方的 MAC 地址 | | 发送方协议地址（SPA） | PLEN（4） | 发送方的 IP 地址 | | 目标硬件地址（THA） | HLEN（6） | 目标的 MAC 地址，ARP 请求中为全 0 | | 目标协议地址（TPA） | PLEN（4） | 目标的 IP 地址 | --- ### **2. 提供的 `buf` 内容** 原始数据： ``` FF FF FF FF FF FF AE AB 32 09 8E B4 08 06 00 01 08 00 06 04 00 01 AE AB 32 09 8E B4 0A 05 01 01 00 00 00 00 00 00 0A 05 01 02 ``` **分解字段：** | 偏移 | 字节范围 | 内容 | 解析说明 | | ---- | ------------------- | ------------------------------------------ | -------------------------------------------- | | 0 | `FF FF FF FF FF FF` | 目标 MAC 地址：广播地址 | 目标为全网广播 | | 6 | `AE AB 32 09 8E B4` | 源 MAC 地址：`AE:AB:32:09:8E:B4` | PC2 的 `tap0` MAC 地址 | | 12 | `08 06` | 上层协议类型：ARP 包 (`0x0806`) | 表示这是一个 ARP 包 | | 14 | `00 01` | 硬件类型：以太网 (`0x0001`) | 表示硬件类型为以太网 | | 16 | `08 00` | 协议类型：IPv4 (`0x0800`) | 表示要解析的协议为 IPv4 | | 18 | `06` | 硬件地址长度（HLEN）：6 | MAC 地址长度为 6 字节 | | 19 | `04` | 协议地址长度（PLEN）：4 | IP 地址长度为 4 字节 | | 20 | `00 01` | 操作码（OPER）：请求 (`0x0001`) | 表示这是一个 ARP 请求包 | | 22 | `AE AB 32 09 8E B4` | 发送方硬件地址（SHA）：`AE:AB:32:09:8E:B4` | 发送方 MAC 地址，来自 PC2 的 `tap0` 接口 | | 28 | `0A 05 01 01` | 发送方协议地址（SPA）：`10.5.1.1` | 发送方 IP 地址 | | 32 | `00 00 00 00 00 00` | 目标硬件地址（THA）：`00:00:00:00:00:00` | 目标 MAC 地址为空，全零（未解析） | | 38 | `0A 05 01 02` | 目标协议地址（TPA）：`10.5.1.2` | 目标 IP 地址（PC1 的 `tap0` 接口的 IP 地址） | --- ### **3. 分析说明** - **目标 MAC 地址（广播）**： 目标 MAC 地址是 `FF:FF:FF:FF:FF:FF`，表示这是一个广播包，发往子网内的所有设备。 - **源 MAC 地址**： 源 MAC 地址是 `AE:AB:32:09:8E:B4`，这对应 PC2 的 `tap0` 接口。 - **操作类型（请求）**： 操作码是 `0x0001`，表明这是一个 ARP 请求包。 - **发送方 IP 地址和 MAC 地址**： 发送方 IP 地址是 `10.5.1.1`，MAC 地址是 `AE:AB:32:09:8E:B4`。 - **目标 IP 地址**： 目标 IP 地址是 `10.5.1.2`，这对应 PC1 的 `tap0` 接口的 IP 地址。 - **目标 MAC 地址为空**： 因为这是一个 ARP 请求，目标的 MAC 地址尚未解析，所以此字段为全零。 --- ### **4. 整体解析结果** PC1 的 `tap0` 接口收到的 `buf` 是一个 **ARP 请求包**，由 PC2 的 `tap0` 接口发送，目的是解析目标 IP 地址 `10.5.1.2` 对应的 MAC 地址。 **PC1 的响应：** - PC1 的 `tap0` 应该生成一个 ARP 响应包，包含以下信息： - 目标 MAC 地址：`AE:AB:32:09:8E:B4`（PC2 的 MAC 地址）。 - 目标 IP 地址：`10.5.1.1`（PC2 的 IP 地址）。 - 源 MAC 地址：PC1 的 `tap0` 的 MAC 地址。 - 源 IP 地址：`10.5.1.2`（PC1 的 IP 地址）。 --- ### **抓包工具验证** 你可以使用 `tcpdump` 或 `Wireshark` 来验证 ARP 包的内容： ```bash sudo tcpdump -i tap0 -vv arp ``` 或者在 Wireshark 中直接查看 ARP 请求的详细信息，与上述解析进行对比。 ![image-20241120184425244](https://lsky.mhrooz.xyz/2024/11/20/d151d433d8965.png) ``` buf :FF FF FF FF FF FF AE AB 32 09 8E B4 08 06 00 01 08 00 06 04 00 01 AE AB 32 09 8E B4 0A 05 01 01 00 00 00 00 00 00 0A 05 01 02 00 00 00 00 00 00 00 00 00 00 00 00 ``` ======= ![image-20241119151751751](https://lsky.mhrooz.xyz/2024/11/19/b3f815eeb9aec.png) ![image-20241119153648360](https://lsky.mhrooz.xyz/2024/11/19/cf14356ea79d8.png) root@pc1:~# tcpdump -i eth1 tcpdump: verbose output suppressed, use -v[v]... for full protocol decode listening on eth1, link-type EN10MB (Ethernet), snapshot length 262144 bytes 10:53:47.911087 IP6 2001:db8:5::2 > ff02::1:ff00:1: ICMP6, neighbor solicitation, who has 2001:db8:5::1, length 32 10:53:47.911189 IP6 2001:db8:5::1 > 2001:db8:5::2: ICMP6, neighbor advertisement, tgt is 2001:db8:5::1, length 32 10:53:47.912325 IP6 2001:db8:5::2 > 2001:db8:5::1: ICMP6, echo request, id 56760, seq 1, length 64 10:53:47.912349 IP6 2001:db8:5::1 > 2001:db8:5::2: ICMP6, echo reply, id 56760, seq 1, length 64 10:53:48.904692 IP6 2001:db8:5::2 > 2001:db8:5::1: ICMP6, echo request, id 56760, seq 2, length 64 10:53:48.904719 IP6 2001:db8:5::1 > 2001:db8:5::2: ICMP6, echo reply, id 56760, seq 2, length 64 10:53:49.906078 IP6 2001:db8:5::2 > 2001:db8:5::1: ICMP6, echo request, id 56760, seq 3, length 64 10:53:49.906103 IP6 2001:db8:5::1 > 2001:db8:5::2: ICMP6, echo reply, id 56760, seq 3, length 64 10:53:50.907512 IP6 2001:db8:5::2 > 2001:db8:5::1: ICMP6, echo request, id 56760, seq 4, length 64 10:53:50.907538 IP6 2001:db8:5::1 > 2001:db8:5::2: ICMP6, echo reply, id 56760, seq 4, length 64 10:53:51.908904 IP6 2001:db8:5::2 > 2001:db8:5::1: ICMP6, echo request, id 56760, seq 5, length 64 10:53:51.908929 IP6 2001:db8:5::1 > 2001:db8:5::2: ICMP6, echo reply, id 56760, seq 5, length 64 10:53:52.926411 IP6 fe80::216:3eff:fe00:2 > 2001:db8:5::2: ICMP6, neighbor solicitation, who has 2001:db8:5::2, length 32 10:53:52.927121 IP6 2001:db8:5::2 > fe80::216:3eff:fe00:2: ICMP6, neighbor advertisement, tgt is 2001:db8:5::2, length 24 13:14:32.958532 IP6 2001:db8:5::1 > 2001:db8:5::2: ICMP6, neighbor advertisement, tgt is 2001:db8:5::2, length 32 0x0000: 0016 3e00 0004 0016 3e00 0602 86dd 6000 ..>.....>.....`. 0x0010: 0000 0020 3aff 2001 0db8 0005 0000 0000 ....:........... 0x0020: 0000 0000 0001 2001 0db8 0005 0000 0000 ................ 0x0030: 0000 0000 0002 8800 484c 6000 0000 2001 ........HL`..... 0x0040: 0db8 0005 0000 0000 0000 0000 0002 0201 ................ 0x0050: 0016 3e00 0602 ..>... ``` 13:14:32.958532 IP6 2001:db8:5::1 > 2001:db8:5::2: ICMP6, neighbor advertisement, tgt is 2001:db8:5::2, length 32 0x0000: 0016 3e00 0004 0016 3e00 0602 86dd 6000 ..>.....>.....`. 0x0010: 0000 0020 3aff 2001 0db8 0005 0000 0000 ....:........... 0x0020: 0000 0000 0001 2001 0db8 0005 0000 0000 ................ 0x0030: 0000 0000 0002 8800 484c 6000 0000 2001 ........HL`..... 0x0040: 0db8 0005 0000 0000 0000 0000 0002 0201 ................ 0x0050: 0016 3e00 0602 ..>... ``` 00:16:3e:00:00:02 这个包是一个 **ICMPv6 邻居通告（Neighbor Advertisement, NA）** 消息，表明发送方（`2001:db8:5::1`）告知接收方（`2001:db8:5::2`），其目标地址（`tgt`）的链路层（MAC）信息。 以下是对这个包的逐字段详细分析： ------ ### **1. 数据包的结构** ICMPv6 邻居通告消息由以下几部分组成： | **字段** | **长度** | **解释** | | ------------------- | -------- | ------------------------------------------------------ | | **以太网帧头** | 14 字节 | 包括源 MAC 地址、目标 MAC 地址和以太网类型。 | | **IPv6 头** | 40 字节 | IPv6 源地址、目的地址，及与数据包相关的信息。 | | **ICMPv6 头** | 4 字节 | 包括类型（Type）、代码（Code）、校验和（Checksum）。 | | **ICMPv6 数据部分** | 可变长度 | 邻居通告消息的具体内容，包括目标地址和链路层地址选项。 | ------ ### **2. 分析具体字段** #### **以太网帧头** ``` 0x0000: 0016 3e00 0004 0016 3e00 0602 86dd ``` | 偏移量 | 字段 | 值 | 解释 | | -------- | ------------- | ------------------- | --------------------------------------- | | `0x0000` | 目标 MAC 地址 | `00:16:3e:00:00:04` | 目标设备的链路层地址（目的 MAC 地址）。 | | `0x0006` | 源 MAC 地址 | `00:16:3e:00:06:02` | 源设备的链路层地址（发送方 MAC 地址）。 | | `0x000c` | 以太网类型 | `0x86dd` | 表示接下来的数据是 IPv6 数据包。 | ------ #### **IPv6 头部** ``` 0x0010: 6000 0000 0020 3aff 2001 0db8 0005 0000 0x0020: 0000 0000 0001 2001 0db8 0005 0000 0000 0x0030: 0000 0000 0002 ``` | 偏移量 | 字段 | 值 | 解释 | | -------- | ---------------- | --------------- | -------------------------------------------- | | `0x0010` | 版本/流量类/流标 | `6000 0000` | IPv6 版本号（6），流量类别（0），流标（0）。 | | `0x0014` | 载荷长度 | `0020` | 载荷长度 32 字节。 | | `0x0016` | 下一头部类型 | `3a` | 表示下一头部为 ICMPv6（58）。 | | `0x0017` | 跳数限制 | `ff` | 初始跳数设置为 255，避免跨链路转发。 | | `0x0018` | 源地址 | `2001:db8:5::1` | 发送方 IPv6 地址。 | | `0x0028` | 目的地址 | `2001:db8:5::2` | 接收方 IPv6 地址。 | ------ #### **ICMPv6 头部** ``` 0x0030: 8800 484c ``` | 偏移量 | 字段 | 值 | 解释 | | -------- | ------------ | ------ | ------------------------------------------------ | | `0x0030` | 类型（Type） | `88` | 表示这是一个邻居通告（Neighbor Advertisement）。 | | `0x0031` | 代码（Code） | `00` | 固定为 0（邻居通告无子代码）。 | | `0x0032` | 校验和 | `484c` | 校验和，确保 ICMPv6 数据的完整性。 | ------ #### **ICMPv6 数据部分** ``` 0x0034: 6000 0000 2001 0db8 0005 0000 0000 0000 0002 0x0050: 0201 0016 3e00 0602 ``` ##### **(a) 邻居通告标志和目标地址** ``` 0x0034: 6000 0000 2001 0db8 0005 0000 0000 0000 0002 ``` | 偏移量 | 字段 | 值 | 解释 | | -------- | -------- | --------------- | ---------------------------------- | | `0x0034` | 目标地址 | `2001:db8:5::2` | 目标设备的 IPv6 地址，告知请求方。 | ##### **(b) 链路层地址选项** ``` 0x0050: 0201 0016 3e00 0602 ``` | 偏移量 | 字段 | 值 | 解释 | | -------- | -------- | ------------------- | ---------------------------------------------------- | | `0x0050` | 选项类型 | `02` | 链路层地址选项（Target Link-Layer Address Option）。 | | `0x0051` | 选项长度 | `01` | 长度为 1（单位：8 字节）。 | | `0x0052` | MAC 地址 | `00:16:3e:00:06:02` | 目标设备的链路层地址（MAC 地址）。 | ------ ### **3. 总结这个包的含义** 1. **包类型**： - 这是一个 **ICMPv6 邻居通告（NA）** 数据包。 2. **发送方信息**： - IPv6 地址：`2001:db8:5::1`。 - MAC 地址：`00:16:3e:00:06:02`。 3. **接收方信息**： - 目标 IPv6 地址：`2001:db8:5::2`。 - 目标链路层地址（MAC）：`00:16:3e:00:04`。 4. **作用**： - 通知目标设备（`2001:db8:5::2`），IPv6 地址 `2001:db8:5::1` 解析为 MAC 地址 `00:16:3e:00:06:02`。 5. **网络流程**： - 这是对之前邻居请求（NS）消息的回复，目标设备将更新其邻居表，以便后续通信。 ------ ### **补充** - **邻居通告的用途**： - 用于响应邻居请求。 - 通知链路上的其他设备该地址的链路层信息。 - **校验关键点**： - 确认 IPv6 头部和 ICMPv6 数据是否正确匹配。 - 确保链路层地址和目标地址一致。 如果你需要进一步分析或有其他问题，请随时补充！