簡(jiǎn)介本資源是北京航空航天大學(xué)研究生《計(jì)算機(jī)網(wǎng)絡(luò)》課程的實(shí)驗(yàn)三完整報(bào)告聚焦ARP協(xié)議原理與跨網(wǎng)段通信機(jī)制適用于高校網(wǎng)絡(luò)課程學(xué)習(xí)者、備考學(xué)生及網(wǎng)絡(luò)技術(shù)初學(xué)者。報(bào)告通過Wireshark抓包分析系統(tǒng)呈現(xiàn)ARP請(qǐng)求/應(yīng)答交互過程、ARP緩存作用、報(bào)文字段結(jié)構(gòu)Opcode、Sender/Target IP/MAC等并對(duì)比同網(wǎng)段與跨網(wǎng)段場(chǎng)景下ARP行為差異輔以默認(rèn)網(wǎng)關(guān)配置驗(yàn)證和ICMP報(bào)文類型解析強(qiáng)化理論與實(shí)操結(jié)合。資源為單個(gè)PDF文件大小僅40KB內(nèi)容精煉、圖表與填表記錄齊全便于快速查閱與復(fù)現(xiàn)實(shí)驗(yàn)。目前已有111人下載學(xué)習(xí)適合用于課后鞏固、實(shí)驗(yàn)預(yù)習(xí)、網(wǎng)絡(luò)協(xié)議理解深化及Wireshark工具入門實(shí)踐。1. 北航研究生計(jì)算機(jī)網(wǎng)絡(luò)實(shí)驗(yàn)一份能跑通ARPICMP全流程的Wireshark實(shí)戰(zhàn)手記這不是一份“抄完交差就扔”的實(shí)驗(yàn)報(bào)告PDF而是一份帶完整報(bào)文上下文、可復(fù)現(xiàn)抓包路徑、含真實(shí)設(shè)備交互邏輯的網(wǎng)絡(luò)層實(shí)操筆記。我去年帶三屆本科生重跑過這份實(shí)驗(yàn)——從VMware虛擬機(jī)配IP、雙網(wǎng)卡橋接、GNS3路由器互聯(lián)到Wireshark過濾表達(dá)式逐幀比對(duì)所有步驟都踩過坑、改過參數(shù)、驗(yàn)證過字段值。它解決的不是“ARP是什么”而是“為什么我的Wireshark里看不到Opcode2的應(yīng)答”“為什么跨網(wǎng)段ping時(shí)Target MAC總是網(wǎng)關(guān)的而不是目標(biāo)主機(jī)的”“為什么ICMP時(shí)間戳報(bào)文的Originate timestamp全是0”這類真正在實(shí)驗(yàn)室里讓人抓耳撓腮的問題。適合正在準(zhǔn)備計(jì)算機(jī)網(wǎng)絡(luò)期末、408統(tǒng)考、或剛接手網(wǎng)絡(luò)運(yùn)維崗需要補(bǔ)底層協(xié)議理解的工程師。如果你手頭只有Wireshark兩臺(tái)Windows虛擬機(jī)一個(gè)能配靜態(tài)路由的路由器甚至用Windows自帶的路由功能湊合這份實(shí)驗(yàn)就能跑通——它不依賴特定硬件但極度依賴對(duì)報(bào)文字段含義的精準(zhǔn)解讀。2. ARP協(xié)議深度拆解從廣播請(qǐng)求到緩存命中每一步都對(duì)應(yīng)真實(shí)報(bào)文字段2.1 為什么ARP請(qǐng)求必須是廣播——鏈路層Destination字段的硬約束ARP工作在數(shù)據(jù)鏈路層與網(wǎng)絡(luò)層之間其根本任務(wù)是解決“已知IP未知MAC”問題。當(dāng)主機(jī)A192.168.1.22要向主機(jī)B192.168.1.21發(fā)ICMP Echo Request時(shí)它先查本地ARP緩存arp -a | findstr 192.168.1.21若無結(jié)果即No ARP Entries Found則構(gòu)造ARP請(qǐng)求報(bào)文。關(guān)鍵點(diǎn)在于此時(shí)主機(jī)A根本不知道主機(jī)B的MAC地址因此無法單播發(fā)送。鏈路層Destination字段必須填全F廣播地址ff:ff:ff:ff:ff:ff確保同一物理網(wǎng)段內(nèi)所有設(shè)備都能收到。Wireshark中選中該報(bào)文在Ethernet II協(xié)議樹下展開可見Destination: Broadcast (ff:ff:ff:ff:ff:ff) Source: VMware_2f:e3:85 (00:0c:29:2f:e3:85) Type: ARP (0x0806)提示不要試圖用arp -s手動(dòng)添加靜態(tài)條目來跳過這步——實(shí)驗(yàn)要求觀察動(dòng)態(tài)學(xué)習(xí)過程硬塞靜態(tài)條目會(huì)直接繞過廣播請(qǐng)求導(dǎo)致后續(xù)分析失真。2.2 Opcode字段的兩種取值request與reply的本質(zhì)差異ARP報(bào)文結(jié)構(gòu)中Hardware Type以太網(wǎng)為1、Protocol TypeIPv4為0x0800、HLEN6字節(jié)、PLEN4字節(jié)均為固定值真正驅(qū)動(dòng)交互的是Opcode字段Opcode 1ARP Request表示“誰(shuí)有192.168.1.21的MAC請(qǐng)告訴我”此時(shí)Target MAC Address字段強(qiáng)制置零00:00:00:00:00:00因?yàn)榘l(fā)起方根本不知道目標(biāo)MACOpcode 2ARP Reply表示“我是192.168.1.21我的MAC是00:0c:29:99:cb:04”此時(shí)Target MAC Address被填入請(qǐng)求方的MAC即00:0c:29:2f:e3:85且報(bào)文變?yōu)閱尾estination字段不再是廣播。在Wireshark中對(duì)比兩條報(bào)文Request報(bào)文的ARP協(xié)議樹下Opcode: request (1)Reply報(bào)文則顯示Opcode: reply (2)。注意Reply報(bào)文的Ethernet II層Destination已變?yōu)檎?qǐng)求方MAC這是協(xié)議強(qiáng)制要求——避免廣播風(fēng)暴。2.3 ARP緩存的生命周期與刷新機(jī)制為什么第二次ping不再觸發(fā)ARP請(qǐng)求實(shí)驗(yàn)報(bào)告中明確指出“ping1-學(xué)號(hào)”截獲報(bào)文少了ARP報(bào)文原因正是ARP緩存生效。Windows默認(rèn)ARP緩存超時(shí)時(shí)間為2分鐘Linux為30秒可通過以下命令驗(yàn)證# 查看當(dāng)前ARP緩存PowerShell Get-NetNeighbor | Where-Object {$_.IPAddress -eq 192.168.1.21} | Format-List # 輸出示例 # LinkLayerAddress : 00-0C-29-99-CB-04 # State : Reachable # Lifetime : 00:01:58 # 剩余存活時(shí)間當(dāng)緩存狀態(tài)為Reachable時(shí)系統(tǒng)直接使用緩存中的MAC地址封裝以太網(wǎng)幀跳過ARP請(qǐng)求流程。若想強(qiáng)制刷新緩存觀察新請(qǐng)求執(zhí)行arp -d 192.168.1.21 # 刪除指定條目 # 或清空全部 arp -a -d注意arp -d后立即pingWireshark必捕獲到新的ARP Request/Reply對(duì)——這是驗(yàn)證緩存機(jī)制最直接的方法。2.4 跨網(wǎng)段ARP的玄學(xué)為什么Target IP是網(wǎng)關(guān)而非目標(biāo)主機(jī)實(shí)驗(yàn)2.6.2中PC A192.168.1.22ping PC B192.168.2.10時(shí)ARP請(qǐng)求的目標(biāo)IP是192.168.1.10PC A的默認(rèn)網(wǎng)關(guān)而非192.168.2.10。這是因?yàn)橹鳈C(jī)路由決策發(fā)生在IP層PC A查路由表發(fā)現(xiàn)192.168.2.10不在直連網(wǎng)段192.168.1.0/24必須轉(zhuǎn)發(fā)給默認(rèn)網(wǎng)關(guān)因此ICMP Echo Request的IP層Destination是192.168.2.10但數(shù)據(jù)鏈路層Destination必須是網(wǎng)關(guān)的MAC——所以ARP請(qǐng)求的對(duì)象是網(wǎng)關(guān)IP192.168.1.10網(wǎng)關(guān)路由器S1收到后根據(jù)自身路由表將報(bào)文轉(zhuǎn)發(fā)至192.168.2.0/24網(wǎng)段并在該網(wǎng)段重新發(fā)起ARP請(qǐng)求獲取PC B的MAC。Wireshark中可清晰看到ARP Reply的Sender IP Address是192.168.1.10網(wǎng)關(guān)Sender MAC Address是網(wǎng)關(guān)接口MAC如3c:e5:a6:45:6b:bc而非PC B的MAC。這是理解三層轉(zhuǎn)發(fā)的關(guān)鍵分水嶺。3. ICMP協(xié)議實(shí)戰(zhàn)解析從Echo到Timestamp字段級(jí)對(duì)照Wireshark原始數(shù)據(jù)3.1 Echo Request/Reply報(bào)文Type字段決定報(bào)文類型Identifier/Sequence保證成對(duì)匹配實(shí)驗(yàn)中ping產(chǎn)生8個(gè)ICMP報(bào)文Wireshark過濾條件為icmp展開ICMP協(xié)議樹可見報(bào)文序號(hào)Type字段值含義Code字段關(guān)鍵字段作用1,3,5,78Echo Request0Identifier(BE)和Sequence number(BE)共同標(biāo)識(shí)本次ping會(huì)話2,4,6,80Echo Reply0Identifier和Sequence number與對(duì)應(yīng)Request完全一致重點(diǎn)說明Identifier和Sequence numberIdentifier(BE)大端序?yàn)?x0a00即十進(jìn)制2560Identifier(LE)小端序?yàn)?x000a即10——這是同一數(shù)值的不同字節(jié)序表示Sequence number(BE)為0x0100256Sequence number(LE)為0x00011Wireshark自動(dòng)將BE值作為主顯示但底層協(xié)議要求收發(fā)雙方按相同字節(jié)序解析。若用Python scapy構(gòu)造自定義ICMP包必須顯式指定byteorderbig或little。驗(yàn)證方法在Wireshark中右鍵任一Request報(bào)文 →Follow → ICMP Stream可直觀看到Request與Reply的Identifier/Sequence嚴(yán)格配對(duì)。3.2 Address Mask Request/Reply已被棄用但仍是理解ICMP擴(kuò)展性的經(jīng)典案例實(shí)驗(yàn)7中pingtest程序發(fā)送Type17的地址掩碼請(qǐng)求Wireshark顯示Request報(bào)文Address mask字段為0.0.0.0全零表示“請(qǐng)告知我的子網(wǎng)掩碼”Reply報(bào)文Address mask為255.255.255.0即0xffffff00與PC A的IPv4配置一致。雖然現(xiàn)代操作系統(tǒng)已基本棄用該功能DHCP或手動(dòng)配置更可靠但其結(jié)構(gòu)揭示了ICMP的擴(kuò)展設(shè)計(jì)思想Type17/18專用于地址掩碼協(xié)商Code恒為0Checksum字段需校驗(yàn)整個(gè)ICMP報(bào)文含IP首部偽首部實(shí)驗(yàn)中0xe3ff與0xe3fe的微小差異源于Reply報(bào)文的Address mask字段值變化證明校驗(yàn)和實(shí)時(shí)計(jì)算有效。提示若Reply報(bào)文Checksum顯示[incorrect]說明Wireshark未正確解析偽首部——需在Edit → Preferences → Protocols → IPv4中勾選Validate the IPv4 checksum if possible。3.3 Timestamp Request/Reply時(shí)間戳字段的“零值陷阱”與UTC基準(zhǔn)實(shí)驗(yàn)8中時(shí)間戳報(bào)文的Originate timestamp、Receive timestamp、Transmit timestamp均顯示為0 seconds after midnight UTC這并非錯(cuò)誤而是pingtest程序未實(shí)現(xiàn)時(shí)間戳填充邏輯的典型表現(xiàn)。標(biāo)準(zhǔn)RFC 792規(guī)定Originate timestamp發(fā)送方記錄報(bào)文生成時(shí)刻毫秒級(jí)UTCReceive timestamp接收方記錄收到報(bào)文時(shí)刻Transmit timestamp接收方記錄發(fā)出Reply時(shí)刻。真實(shí)環(huán)境中如用hping3發(fā)送這三個(gè)字段應(yīng)有顯著差異。例如hping3 -C 13 -E 13 -p 80 192.168.1.21 # 發(fā)送Timestamp RequestWireshark中可見Originate timestamp為非零值如1712345678.123而實(shí)驗(yàn)報(bào)告中全為0恰恰說明pingtest是教學(xué)簡(jiǎn)化版——它只構(gòu)造報(bào)文框架不填充時(shí)間戳。這是理解協(xié)議規(guī)范與實(shí)際工具實(shí)現(xiàn)差距的重要案例。3.4 ICMP差錯(cuò)報(bào)文Destination Unreachable與Time Exceeded的封裝結(jié)構(gòu)實(shí)驗(yàn)9-10中兩類關(guān)鍵差錯(cuò)報(bào)文Destination UnreachableType3, Code0當(dāng)S1路由器無10.1.4.10路由時(shí)返回其ICMP載荷中嵌套了原始Echo Request的IP首部前8字節(jié)ICMP數(shù)據(jù)即IdentifierSequence用于源主機(jī)定位出錯(cuò)報(bào)文Time ExceededType11, Code0tracert利用TTL遞減機(jī)制每經(jīng)過一跳路由器TTL減1歸零時(shí)返回該報(bào)文載荷同樣封裝原始Echo Request的IPICMP頭部。在Wireshark中展開差錯(cuò)報(bào)文的Internet Control Message Protocol→Internet Protocol→Internet Control Message Protocol可見嵌套結(jié)構(gòu)。這是ICMP差錯(cuò)報(bào)文的設(shè)計(jì)精髓不新建會(huì)話而是復(fù)用原報(bào)文上下文定位問題。4. Wireshark抓包實(shí)戰(zhàn)從環(huán)境搭建到過濾表達(dá)式避開90%新手翻車點(diǎn)4.1 虛擬機(jī)網(wǎng)絡(luò)拓?fù)渑渲肰Mware橋接模式下的IP與網(wǎng)關(guān)設(shè)置實(shí)驗(yàn)要求PC A與PC B位于不同網(wǎng)段如192.168.1.0/24與192.168.2.0/24需通過路由器S1互通。在VMware Workstation中PC A虛擬機(jī)網(wǎng)絡(luò)適配器設(shè)為BridgedIPv4地址192.168.1.22子網(wǎng)掩碼255.255.255.0默認(rèn)網(wǎng)關(guān)填192.168.1.10S1的e0/1接口IPPC B虛擬機(jī)同設(shè)BridgedIPv4地址192.168.2.10子網(wǎng)掩碼255.255.255.0默認(rèn)網(wǎng)關(guān)填192.168.2.10S1的e0/2接口IPS1路由器需啟用IP路由功能Windows Server可用netsh interface ipv4 set interface Ethernet forwardingenabled。注意若用GNS3模擬路由器務(wù)必關(guān)閉ip routing的默認(rèn)關(guān)閉狀態(tài)否則S1僅作二層交換機(jī)無法轉(zhuǎn)發(fā)跨網(wǎng)段報(bào)文。4.2 Wireshark啟動(dòng)與過濾精準(zhǔn)捕獲ARP/ICMP避免海量無關(guān)流量啟動(dòng)Wireshark前先確定監(jiān)聽網(wǎng)卡PC A上運(yùn)行ipconfig找到對(duì)應(yīng)192.168.1.22的網(wǎng)卡名稱如以太網(wǎng)在Wireshark中選擇該網(wǎng)卡點(diǎn)擊捕獲按鈕。關(guān)鍵過濾表達(dá)式Capture Filter影響抓包性能arp or icmp顯示過濾表達(dá)式Display Filter不影響抓包僅篩選顯示查看ARP交互arp查看ICMP Echoicmp.type 8 || icmp.type 0查看跨網(wǎng)段ARParp.dst.proto_ipv4 192.168.1.10查看差錯(cuò)報(bào)文icmp.type 3 || icmp.type 11提示Capture Filter在抓包前設(shè)置能極大減少CPU占用Display Filter在抓包后使用支持復(fù)雜邏輯。新手?；煜邔?dǎo)致Wireshark卡死。4.3 報(bào)文導(dǎo)出與比對(duì)用Excel表格固化實(shí)驗(yàn)結(jié)論實(shí)驗(yàn)報(bào)告要求填寫多張表格如ARP請(qǐng)求/應(yīng)答字段對(duì)比手動(dòng)錄入易出錯(cuò)。推薦自動(dòng)化方案Wireshark中選中目標(biāo)報(bào)文 → 右鍵Export Packet Dissections → As CSV...用Python pandas讀取CSV提取關(guān)鍵字段import pandas as pd df pd.read_csv(arp_packets.csv) # 提取ARP字段 arp_fields df[df[Protocol] ARP][[No., Source, Destination, Info]] print(arp_fields.to_string(indexFalse))將輸出粘貼至Excel用條件格式高亮Opcode1與Opcode2行直觀比對(duì)字段差異。此法避免手誤且可復(fù)用腳本批量處理多組實(shí)驗(yàn)數(shù)據(jù)。4.4 常見問題排查血淚經(jīng)驗(yàn)總結(jié)的5個(gè)致命坑現(xiàn)象1Wireshark捕獲不到任何ARP報(bào)文arp -a顯示緩存為空原因PC A與PC B不在同一物理網(wǎng)段但VMware網(wǎng)絡(luò)適配器未正確橋接到宿主機(jī)物理網(wǎng)卡導(dǎo)致虛擬機(jī)間通信走NAT而非橋接。解決在VMware設(shè)置中確認(rèn)網(wǎng)絡(luò)適配器為Bridged并勾選Replicate physical network connection state若宿主機(jī)WiFi不穩(wěn)定改用有線網(wǎng)卡橋接。現(xiàn)象2跨網(wǎng)段ping通但Wireshark只看到PC A發(fā)往網(wǎng)關(guān)的ARP看不到網(wǎng)關(guān)發(fā)往PC B的ARP原因Wireshark僅在PC A網(wǎng)卡捕獲而網(wǎng)關(guān)到PC B的ARP發(fā)生在另一物理網(wǎng)段192.168.2.0/24需在PC B或S1上抓包。解決在PC B上同步啟動(dòng)Wireshark過濾arp arp.dst.proto_ipv4 192.168.2.10即可捕獲網(wǎng)關(guān)發(fā)起的ARP請(qǐng)求?，F(xiàn)象3ICMP Reply報(bào)文的Identifier與Request不一致原因pingtest程序每次運(yùn)行生成隨機(jī)Identifier而實(shí)驗(yàn)要求連續(xù)兩次ping使用相同Identifier如ping -i 1000 -n 1 192.168.1.21中-i指定間隔但I(xiàn)dentifier仍可能變。解決改用hping3固定Identifierhping3 -c 1 -i 1 --icmp --icmp-type 8 --icmp-ident 2560 --icmp-seq 1 192.168.1.21現(xiàn)象4tracert返回的TTL超時(shí)報(bào)文Wireshark中Time-to-live exceeded顯示為[Malformed Packet]原因Wireshark版本過低3.2對(duì)IPv4分片報(bào)文解析異?；虿东@時(shí)啟用了Promiscuous mode導(dǎo)致混雜模式干擾。解決升級(jí)Wireshark至最新穩(wěn)定版如3.6.16并在捕獲選項(xiàng)中取消勾選Enable promiscuous mode?，F(xiàn)象5ARP Reply報(bào)文中Target MAC Address顯示為00:00:00:00:00:00而非目標(biāo)MAC原因Wireshark解析ARP協(xié)議時(shí)將Reply報(bào)文的Target MAC字段誤讀為Request報(bào)文的占位符因RFC未強(qiáng)制要求Reply填Target MAC但實(shí)現(xiàn)中必須填。解決手動(dòng)檢查Ethernet II層Destination字段——它才是真正的目標(biāo)MAC。Wireshark的ARP解析樹存在顯示bug以鏈路層字段為準(zhǔn)。5. 實(shí)驗(yàn)進(jìn)階技巧用Python自動(dòng)化驗(yàn)證ARP緩存刷新與ICMP字段一致性5.1 自動(dòng)化ARP緩存狀態(tài)監(jiān)控實(shí)時(shí)檢測(cè)Reachable超時(shí)手動(dòng)執(zhí)行arp -a再肉眼找Lifetime太低效。用Python調(diào)用Windows API獲取精確緩存狀態(tài)import subprocess import re from datetime import datetime, timedelta def get_arp_entry(ip): 獲取指定IP的ARP緩存條目及剩余壽命 try: result subprocess.run([arp, -a, ip], capture_outputTrue, textTrue, checkTrue) lines result.stdout.strip().split(\n) for line in lines: if ip in line and dynamic in line: # 解析Lifetime: 00:01:58 lifetime_match re.search(rLifetime\s*:\s*(\d{2}:\d{2}:\d{2}), line) if lifetime_match: hms lifetime_match.group(1).split(:) remaining timedelta(hoursint(hms[0]), minutesint(hms[1]), secondsint(hms[2])) return { mac: line.split()[1], state: Reachable, remaining: remaining } return None except subprocess.CalledProcessError: return None # 監(jiān)控循環(huán) target_ip 192.168.1.21 while True: entry get_arp_entry(target_ip) if entry and entry[remaining] timedelta(seconds10): print(f[{datetime.now()}] ARP緩存即將過期剩余{entry[remaining]}觸發(fā)刷新...) subprocess.run([arp, -d, target_ip]) # 立即ping觸發(fā)新ARP subprocess.run([ping, -n, 1, target_ip]) else: print(f[{datetime.now()}] 緩存正常剩余{entry[remaining] if entry else N/A}) time.sleep(5)此腳本每5秒檢查一次緩存剩余時(shí)間低于10秒時(shí)自動(dòng)刪除并觸發(fā)新ARP——比人工操作更精準(zhǔn)且可記錄日志分析緩存波動(dòng)規(guī)律。5.2 ICMP報(bào)文字段一致性校驗(yàn)用Scapy構(gòu)造并比對(duì)原始字節(jié)實(shí)驗(yàn)報(bào)告要求比對(duì)Request/Reply字段但手動(dòng)核對(duì)易漏。用Scapy生成標(biāo)準(zhǔn)報(bào)文導(dǎo)出原始字節(jié)與Wireshark捕獲對(duì)比from scapy.all import * import binascii # 構(gòu)造標(biāo)準(zhǔn)Echo Request pkt IP(dst192.168.1.21)/ICMP(type8, code0, id2560, seq1)/Hello # 獲取原始字節(jié) raw_bytes bytes(pkt) print(Echo Request原始字節(jié)十六進(jìn)制:) print(binascii.hexlify(raw_bytes).decode()) # 構(gòu)造Reply需修改IP層src/dst及ICMP type reply_pkt IP(src192.168.1.21, dst192.168.1.22)/ICMP(type0, code0, id2560, seq1)/Hello reply_bytes bytes(reply_pkt) print(\nEcho Reply原始字節(jié)十六進(jìn)制:) print(binascii.hexlify(reply_bytes).decode())將輸出十六進(jìn)制字符串復(fù)制到Wireshark的Hex Dump面板用CtrlF搜索對(duì)應(yīng)字段如0a00為Identifier BE值可100%確認(rèn)字段位置與值——這是協(xié)議逆向分析的基石技能。5.3 Wireshark過濾表達(dá)式調(diào)試用布爾邏輯組合多條件實(shí)驗(yàn)中需同時(shí)滿足“ARP報(bào)文”“Opcode2”“Target IP為192.168.1.21”單一過濾不夠。組合表達(dá)式arp arp.opcode 2 arp.dst.proto_ipv4 192.168.1.21更進(jìn)一步排除廣播ARP只看單播Replyarp arp.opcode 2 arp.dst.proto_ipv4 192.168.1.21 !eth.dst ff:ff:ff:ff:ff:ffWireshark支持與、||或、!非、等于、!不等于等運(yùn)算符合理組合可精準(zhǔn)定位任意報(bào)文特征。5.4 實(shí)驗(yàn)報(bào)告表格自動(dòng)化生成PandasLaTeX輸出專業(yè)文檔手繪表格易錯(cuò)且不美觀。用Python生成LaTeX表格import pandas as pd # 定義ARP字段對(duì)比數(shù)據(jù) data { 字段項(xiàng): [鏈路層 Destination項(xiàng), 鏈路層 Source項(xiàng), 網(wǎng)絡(luò)層Sender MAC Address, 網(wǎng)絡(luò)層Sender IP Address, 網(wǎng)絡(luò)層Target MAC Address, 網(wǎng)絡(luò)層Target IP Address], ARP 請(qǐng)求數(shù)據(jù)報(bào)文: [Broadcast(ff:ff:ff:ff:ff:ff), Vmware_2f:e3:85(00:0c:29:2f:e3:85), Vmware_2f:e3:85(00:0c:29:2f:e3:85), 192.168.1.22(192.168.1.22), 00:00:00_00:00:00(00:00:00:00:00:00), 192.168.1.21(192.168.1.21)], ARP 應(yīng)答數(shù)據(jù)報(bào)文: [Vmware_99:cb:04(00:0c:29:99:cb:04), Vmware_99:cb:04(00:0c:29:99:cb:04), Vmware_99:cb:04(00:0c:29:99:cb:04), 192.168.1.21(192.168.1.21), Vmware_2f:e3:85(00:0c:29:2f:e3:85), 192.168.1.22(192.168.1.22)] } df pd.DataFrame(data) # 導(dǎo)出為L(zhǎng)aTeX表格 latex_table df.to_latex(indexFalse, escapeFalse, column_format|l|l|l|) print(latex_table)輸出可直接粘貼至Overleaf編譯生成符合學(xué)術(shù)規(guī)范的表格——從此告別手繪表格的像素級(jí)對(duì)齊噩夢(mèng)。從那以后我每次做網(wǎng)絡(luò)協(xié)議實(shí)驗(yàn)都強(qiáng)制走一遍ARP緩存監(jiān)控腳本Scapy字段校驗(yàn)?zāi)呐轮皇球?yàn)證一個(gè)簡(jiǎn)單ping。因?yàn)閰f(xié)議細(xì)節(jié)藏在字節(jié)里而人眼會(huì)疲勞機(jī)器不會(huì)。希望幫到你。本文還有配套的精品資源點(diǎn)擊獲取