ARPFieldCombinationNotes

Columns

• Combination topic links each row to a topic of its own, e.g. ARPFieldComboRow151, listing every topic the row fits, the one it’s counted as first.
• Rows run in nested order: Non-host IP changes slowest, then Eth dst, Eth src, Opcode, Sender MAC, Target MAC, IPs, and finally Eth src = Sender MAC, which changes fastest, so the two rows for a unicast Ethernet src and Sender MAC sit side by side.
• IPs compares Sender IP with Target IP. It has five states rather than three, because 0.0.0.0 means something different in each IP field:
  • equal: both IPs the same and not 0.0.0.0
  • different: both real IPs, not the same
  • sender 0.0.0.0: an ARP probe, if it’s a request
  • target 0.0.0.0: a reply to an ARP probe, if it’s a reply - see ARPProbeReplyMessages
  • both 0.0.0.0: always invalid
• Eth src = Sender MAC says whether Ethernet src and Sender MAC are the same address. Where both are unicast it can go either way, so those rows appear twice, once for each answer. Otherwise it follows from the two values.
• Non-host IP says whether Sender IP or Target IP is 255.255.255.255, in 224.0.0.0/4 (multicast) or in 127.0.0.0/8 (loopback), none of which a host can have. It’s yes only in InvalidARPIP’s rows, so ListOfValidARPFieldCombinations leaves it out. It changes slowest so that rows 1-1,350, the no rows, kept their numbers when it was added. A subnet’s own broadcast or network address, e.g. a .255, can’t be judged from the packet, which carries no netmask, so arp_packet_categoriser reports those separately under “ARP using the subnet’s own addresses”, using the config’s subnet.
• In the by-topic table, any means every value occurs among the rows that fit the topic, not X means every value except X, and a or b lists the values that occur. Each row covers every mix of its values, except Eth src = Sender MAC, which still follows from Eth src and Sender MAC when either isn’t unicast.
• That makes 3 × 3 × 3 × 3 × 3 × 5 = 1,215 combinations, plus 135 where a unicast Ethernet src and unicast Sender MAC don’t match: 1,350 with Non-host IP no. Non-host IP yes can’t go with both IPs 0.0.0.0, so it adds 3 × 3 × 3 × 3 × 3 × 4 = 972, plus 108 mismatches: 1,080 more, 2,430 in all.
  • 2 options for non-host ip
  • 3 options for eth dst
  • 3 options for eth src
  • 3 options for opcode
  • 3 options for sender mac
  • 3 options for target mac
  • 5 options for ips

Why rows are invalid

A row can break more than one rule. It fits each topic whose rule it breaks, and its row topic (e.g. ARPFieldComboRow151) lists them all. The first in this order is the one it’s counted as, which is what arp_packet_categoriser reports. Each topic’s Rows, Profile and filters cover every row that fits it, so they overlap.

All 72 valid rows have Ethernet src and Sender MAC unicast. Half have them matching and half not. The 36 that don’t match have topics of their own, named after the matching row’s topic with SenderMACMismatch on the end.