Heads up! These docs are for STIX 1.1.1, which is not the latest version (1.2). View the latest!

ARPTypeNetwork Packet Object Schema

The Address Resolution Protocol is a request and reply protocol that runs encapsulated by the line protocol. It is communicated within the boundaries of a single network, never routed across internetwork nodes. This property places ARP into the Link Layer. It is encapsulated. REF: http://www.comptechdoc.org/independent/networking/guide/netarp.html.


Fields

Field Name Type Description
Hardware_Addr_Type0..1 IANAHardwareType

Characterizes the type of hardware address specified in an ARP message.

Proto_Addr_Type0..1 IANAEtherType

ProtoAddrType characterizes the type of protocol address being mapped. For IPv4 addresses, value = 0x0800.

Hardware_Addr_Size0..1 HexBinaryObjectPropertyType

Harware_Addr_Size represents the byte size of the hardware address. For Ethernet or other IEEE 802 MAC addresses, the value is 6.

Proto_Addr_Size0..1 HexBinaryObjectPropertyType

Proto_Addr_Size represents the byte size of the protocol address. IPv4 addresses = 4.

Op_Type0..1 ARPOpType

Op_Type characterizes the type of operation. 1 = ARP request, 2=ARP reply, 3=RARP request, 4=RARP reply.

Sender_Hardware_Addr0..1 AddressObjectType

Sender_Hardware_Addr characterizes the sender's hardware address (e.g., MAC address).

Sender_Protocol_Addr0..1 AddressObjectType

Sender_Protocol_Addr characterizes the sender's IP address.

Recip_Hardware_Addr0..1 AddressObjectType

Recip_Sender_Hardware Addr characterizes the recipients' hardware address (e.g., MAC address).

Recip_Protocol_Addr0..1 AddressObjectType

Recip Protocol Addr characterizes the recipient's IP address.