The Request

ARP Fixed Header

The ARP payload starts by naming the address families, sizes, and request opcode.

highlighted = computed this step

The payload starts with sizes

Before the addresses, ARP states which address sizes it is using. This request uses Ethernet hardware addresses and IP version 4 protocol addresses.

hlen=6,plen=4\text{hlen}=6,\quad \text{plen}=4
ARP fixed headerThe ARP payload fields are decoded from the same pinned request frame.ARP fixed header224 bits / 28 bytes0x0001080006040001001122334455c0a8010a000000000000c0a80101byte 0byte 1byte 2byte 300000000000000010000100000000000byte 4byte 5byte 6byte 700000110000001000000000000000001byte 8byte 9byte 10byte 1100000000000100010010001000110011byte 12byte 13byte 14byte 1501000100010101011100000010101000byte 16byte 17byte 18byte 1900000001000010100000000000000000byte 20byte 21byte 22byte 2300000000000000000000000000000000byte 24byte 25byte 26byte 2711000000101010000000000100000001htype1ptype0x0800hlen6plen4opcode1sender-mac0x001122334455(cont.)sender-ip192.168.1.10(cont.)(cont.)target-mac0x000000000000target-ip192.168.1.1

Hardware and protocol types

Hardware type 1 names Ethernet here. Protocol type 0x0800 names IP version 4.

htype=1,ptype=0x0800\text{htype}=1,\quad \text{ptype}=0x0800
ARP fixed headerThe ARP payload fields are decoded from the same pinned request frame.ARP fixed header224 bits / 28 bytes0x0001080006040001001122334455c0a8010a000000000000c0a80101byte 0byte 1byte 2byte 300000000000000010000100000000000byte 4byte 5byte 6byte 700000110000001000000000000000001byte 8byte 9byte 10byte 1100000000000100010010001000110011byte 12byte 13byte 14byte 1501000100010101011100000010101000byte 16byte 17byte 18byte 1900000001000010100000000000000000byte 20byte 21byte 22byte 2300000000000000000000000000000000byte 24byte 25byte 26byte 2711000000101010000000000100000001htype1ptype0x0800hlen6plen4opcode1sender-mac0x001122334455(cont.)sender-ip192.168.1.10(cont.)(cont.)target-mac0x000000000000target-ip192.168.1.1

Opcode asks a question

Opcode 1 means this payload is a request: who has the target IP address.

opcode=1\text{opcode}=1
ARP fixed headerThe ARP payload fields are decoded from the same pinned request frame.ARP fixed header224 bits / 28 bytes0x0001080006040001001122334455c0a8010a000000000000c0a80101byte 0byte 1byte 2byte 300000000000000010000100000000000byte 4byte 5byte 6byte 700000110000001000000000000000001byte 8byte 9byte 10byte 1100000000000100010010001000110011byte 12byte 13byte 14byte 1501000100010101011100000010101000byte 16byte 17byte 18byte 1900000001000010100000000000000000byte 20byte 21byte 22byte 2300000000000000000000000000000000byte 24byte 25byte 26byte 2711000000101010000000000100000001htype1ptype0x0800hlen6plen4opcode1sender-mac0x001122334455(cont.)sender-ip192.168.1.10(cont.)(cont.)target-mac0x000000000000target-ip192.168.1.1

Summary

The fixed ARP header is not guessed from prose. The hardware type, protocol type, sizes, and opcode are all sliced from the payload bytes.

opcode request=1\text{opcode request}=1
ARP fixed headerThe ARP payload fields are decoded from the same pinned request frame.ARP fixed header224 bits / 28 bytes0x0001080006040001001122334455c0a8010a000000000000c0a80101byte 0byte 1byte 2byte 300000000000000010000100000000000byte 4byte 5byte 6byte 700000110000001000000000000000001byte 8byte 9byte 10byte 1100000000000100010010001000110011byte 12byte 13byte 14byte 1501000100010101011100000010101000byte 16byte 17byte 18byte 1900000001000010100000000000000000byte 20byte 21byte 22byte 2300000000000000000000000000000000byte 24byte 25byte 26byte 2711000000101010000000000100000001htype1ptype0x0800hlen6plen4opcode1sender-mac0x001122334455(cont.)sender-ip192.168.1.10(cont.)(cont.)target-mac0x000000000000target-ip192.168.1.1