On 5/15/07, ninny <ninny12 / hotmail.com> wrote:> Hello,>> I have a project to do in ruby witch consist in recover the ARP requests> (who-has) on my local network and take the IP address if nobody answer> to the ARP requests.> I know identify an ARP request with "pcap" but I don't know how to take> the IP address.

Not really sure about how you'd do this in ruby, but I have asuggestion, if you are trying to monitor ARP requests on the networkand also ARP replies I am afraid, you'd not see most (infact allexcept your own) of the ARP replies (standards compliant ARP repliesare not sent to broadcast MAC address) and you might end up thinkingnobody replied. Not sure whether this really is a very good idea.
Coming back to ARP ( Here is how the frame is like)
EtherType : 0x0806ARP Data: First 8 byte headersNext : 6 byte (Sender MAC address - Assuming Ethernet)Next : 4 byte (Sender IP Address)Next : 6 byte (Destination MAC)Next : 4 byte Destination IP..
So in short you've to match 4 bytes at offset 24, to find the Addressthat doesn't get replied. Don't know how this is done with pcap inruby.
HTH,
-abhijit


>> If someone want help me, I would be very happy>> --> Posted via http://www.ruby-forum.com/.>>

-- 
[ written in http://www.paahijen.com/scratchpad ]
[ http://www.paahijen.com ]