Row (field combination): one set of values for the fields that matter: Ethernet dst, Ethernet src, Opcode, Sender MAC, Target MAC, how Sender IP compares with Target IP, whether Ethernet src matches Sender MAC, and whether either IP is a broadcast, multicast or loopback address. Each row has a topic of its own, e.g. ARPFieldComboRow151, and a line in the Full List Of All ARP Field Combinations
Shape: a topic for the rows that look the same on the wire, read off the packet alone, e.g. GratuitousARPReply. Its Profile gives the field values, and its BPF and Wireshark display filters catch them
Fits / counted as: a valid row fits one shape, but an invalid row breaking several rules fits a shape for each. It is counted as the first, and its topic’s Fits list marks that one “(counted as)”
SenderMACMismatch variant: a shape’s twin whose Ethernet src doesn’t match Sender MAC, e.g. GratuitousARPReplySenderMACMismatch. It shares its base shape’s family
Family: the kind of message, also read off the packet. A valid shape’s family is decided by how Sender IP compares with Target IP, and every invalid shape is in InvalidARPMessages. Each shape is in exactly one family, named on its Family line:
Group: a hand-written topic for part of a family, e.g. GratuitousARPRequest, the request shapes of GratuitousARPMessages. It isn’t generated, so its list of shapes is kept by hand
Purpose: what a packet is sent for, which can’t be read off the packet, e.g. ARPAnnouncement, ARPDuplicateAddressDetection or ARPSpoofing. The same shape can serve several purposes, and the same purpose can use several shapes
Generated lines: ARPTablesAndFilters rewrites the tables, each row’s Fits list, each family’s Shapes list, and each shape’s run from its Family line to its Wireshark display filter. Everything else in these topics is notes and is left alone
Row vs shape
A row is one exact set of field values. There are 2,430, one for every possible combination of the fields above, whether it makes sense or not, which is why the Full List Of All ARP Field Combinations is useful for fuzzing. A row topic carries almost nothing of its own, just a Fits list naming the shapes it belongs to.
A shape is a named kind of packet. It groups the rows that count as the same packet, and they may differ in any field that doesn’t change what the packet is. There are 52, each with a family, its rows, a Profile, filters and notes. GratuitousARPReply, for example, covers ARPFieldComboRow511, ARPFieldComboRow521 and ARPFieldComboRow531, which differ only in Target MAC (unicast, ff:ff:ff:ff:ff:ff or 00:00:00:00:00:00). A receiver treats all three alike, so its Profile leaves Target MAC out and its filters don’t test it, and one filter catches all three.
Every valid row is in exactly one shape, and an invalid row breaking several rules fits a shape for each. So a row is the raw data and a shape is the name and meaning given to a set of rows. Notes about what a packet is or does belong on the shape, and a row topic is for anything true of that one exact combination only.
MIKE HIGGINBOTTOM