CVE-2017-13013 (Other, published 2017-09-14T06:29Z)
Description: value: The ARP parser in tcpdump before 4.9.2 has a buffer over-read in print-arp.c, several functions.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/the-tcpdump-group/tcpdump
Files changed:
print-arp.c
tests/TESTLIST
tests/arp-oobr.out
tests/getname_2_read4_asan.out
Commit message: CVE-2017-13013/ARP: Fix printing of ARP protocol addresses.

If the protocol type isn't ETHERTYPE_IP or ETHERTYPE_TRAIL, or if the
protocol address length isn't 4, don't print the address as an IPv4 address.

This fixes a buffer over-read discovered by Bhargava Shastry,
SecT/TU Berlin.

Add a test using the capture file supplied by the reporter(s), modified
so the capture file won't be rejected as an invalid capture.

Update another test file's tcpdump output to reflect this change.


Vulnerable code:
#define ar_sha(ap)	(((const u_char *)((ap)+1))+0)
		ND_PRINT((ndo, "who-has %s", ipaddr_string(ndo, ATMTPA(ap))));
		ND_PRINT((ndo, "tell %s", ipaddr_string(ndo, ATMSPA(ap))));
		ND_PRINT((ndo, "%s is-at ", ipaddr_string(ndo, ATMSPA(ap))));
		ND_PRINT((ndo, "at %s", ipaddr_string(ndo, ATMSPA(ap))));
		ND_PRINT((ndo, "for %s", ipaddr_string(ndo, ATMSPA(ap))));
	if (!ND_TTEST2(*ar_tpa(ap), PROTO_LEN(ap))) {
		ND_PRINT((ndo, "who-has %s", ipaddr_string(ndo, TPA(ap))));
		ND_PRINT((ndo, " tell %s", ipaddr_string(ndo, SPA(ap))));
		ND_PRINT((ndo, "%s is-at %s",
                          ipaddr_string(ndo, SPA(ap)),
		ND_PRINT((ndo, "%s at %s",
			  linkaddr_string(ndo, THA(ap), linkaddr, HRD_LEN(ap)),
			  ipaddr_string(ndo, TPA(ap))));
		ND_PRINT((ndo,"%s at %s",
			  linkaddr_string(ndo, SHA(ap), linkaddr, HRD_LEN(ap)),
			  ipaddr_string(ndo, SPA(ap))));
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Unknown Hardware (37) (len 6), Unknown Protocol (0x0000) (len 4), Request who-has 192.168.1.1 tell 152.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:fa:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), 802.1Q-9200 (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:25:00 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x2500) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:59 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x4b00) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:25:00 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x3100) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Unknown Hardware (34) (len 6), Unknown Protocol (0x0849) (len 4), Request who-has 192.66.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0841) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0xda00) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0xbc00) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:31 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x7a00) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:fb:ff:ff, ethertype ARP (0x0806), length 60: Unknown Hardware (37) (len 6), Unknown Protocol (0x0000) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:21:5a:21:9e:fd > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0854) (len 4), Request who-has 192.168.0.1 tell 192.168.0.35, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 12), Request who-has 0.0.0.0 (01:01:00:00:00:00) tell 192.168.1.104, length 46
00:1f:39:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0801) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:78:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x08ae) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0801) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 0), Unknown Protocol (0x0825) (len 4), Request who-has 45.121.192.168 tell 0.31.41.218, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x2500) (len 4), Request who-has 192.168.1.1 tell 192.170.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 5), Request who-has 168.1.1.0 (00:00:00:00:00:c0) tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0880) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x2500) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 0), Unknown Protocol (0x0825) (len 4), Request who-has 45.121.192.168 tell 0.31.41.218, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 0), Unknown Protocol (0x0825) (len 4), Request who-has 45.121.192.168 tell 0.31.41.218, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x4800) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:13:20:13:db:6f > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0855) (len 4), Request who-has 192.168.0.38 tell 192.168.0.31, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0884) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x085a) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x08f3) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
10:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x080a) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0873) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x6800) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:2d:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0810) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Unknown Hardware (37) (len 6), Unknown Protocol (0x0000) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Unknown Hardware (37) (len 6), Unknown Protocol (0x0000) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:13:20:13:db:6f > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x084e) (len 4), Request who-has 192.168.0.33 tell 192.168.0.31, length 46
25:00:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 0), Unknown Protocol (0x0825) (len 4), Request who-has 45.121.192.168 tell 37.0.41.218, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0xd000) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:61:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0801) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x5700) (len 4), Request who-has 192.168.1.1 (00:00:ab:00:00:00) tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x086d) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:21:d8:01:03:45 > 00:08:02:7e:b2:36, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x081a) (len 4), Reply 192.168.0.1 is-at 00:21:d8:01:03:45, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0835) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0802) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:67:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0855) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0a00) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x2500) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0xf300) (len 4), Request who-has 192.168.1.1 (58:00:00:00:00:00) tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > b2:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x4c00) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Unknown Hardware (37) (len 6), Unknown Protocol (0x0000) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0801) (len 4), Request who-has 192.168.1.211 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0810) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0875) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x08b2) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0856) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x081e) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x4e00) (len 4), Request who-has 192.168.1.1 tell 202.168.1.104, length 46
00:1f:29:da:99:79 > ff:ff:ff:ff:ff:7f, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x08b5) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0808) (len 4), Request who-has 192.168.1.1 tell 200.168.1.104, length 46
02:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0880) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x086a) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 0), Unknown Protocol (0x0825) (len 4), Request who-has 45.121.192.168 tell 0.31.41.218, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0870) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x5700) (len 4), Request who-has 192.168.1.1 tell 97.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0a00) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:21:d8:01:03:45 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x4800) (len 4), Request who-has 192.168.0.160 (00:00:36:00:00:00) tell 192.168.0.1, length 46
00:21:d8:01:03:45 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x7100) (len 4), Request who-has 192.168.0.160 tell 192.168.0.1, length 46
00:21:d8:01:03:45 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0871) (len 4), Request who-has 192.168.0.160 tell 192.168.0.1, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x5800) (len 4), Request who-has 192.168.3.1 (00:00:00:00:80:00) tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 12), Request who-has 0.0.0.0 (01:01:00:00:00:00) tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:7f:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0840) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0900) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0801) (len 4), Request who-has 192.184.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:87:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0804) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0820) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0844) (len 4), Request who-has 192.168.1.1 tell 0.168.1.104, length 46
00:13:20:13:db:6f > ff:ff:71:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 0), Unknown Protocol (0x0825) (len 4), Request who-has 219.111.192.168 tell 0.19.32.19, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x2d00) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:13:20:13:db:6f > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0873) (len 4), Request who-has 192.168.0.37 tell 192.168.0.31, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x7000) (len 4), Request who-has 37.80.232.1 tell 192.168.1.104, length 46
00:13:20:13:db:6f > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x2800) (len 4), Request who-has 192.168.0.1 tell 192.168.0.31, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x6c00) (len 4), Request who-has 192.168.1.1 tell 192.168.1.144, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:4e:ff, ethertype ARP (0x0806), length 60: Unknown Hardware (50) (len 6), Unknown Protocol (0x0820) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0833) (len 4), Request who-has 192.168.33.1 tell 192.168.1.104, length 46
00:13:20:13:db:6f > ff:ff:ff:ff:ff:ba, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0870) (len 4), Request who-has 192.168.0.38 (00:00:00:d0:00:00) tell 192.168.0.31, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 0), Unknown Protocol (0x0825) (len 4), Request who-has 45.121.192.168 tell 0.31.41.218, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x1f00) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0a00) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0900) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:3a:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0840) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0874) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0xce00) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:f9 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0xb200) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 0), Unknown Protocol (0x0825) (len 4), Request who-has 45.121.192.168 tell 0.31.41.218, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x2500) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:47:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0808) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x086f) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0802) (len 4), Request who-has 192.168.1.1 (00:6a:00:00:00:00) tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x082e) (len 4), Request who-has 192.168.1.1 tell 192.168.1.104, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Unknown Hardware (37) (len 6), Unknown Protocol (0x0000) (len 4), Request who-has 192.168.1.1 tell 192.168.17.104, length 46

Fixed code:
#define ar_sha(ap)	(((const u_char *)((ap)+1))+  0)
static void
tpaddr_print_ip(netdissect_options *ndo,
	        const struct arp_pkthdr *ap, u_short pro)
{
	if (pro != ETHERTYPE_IP && pro != ETHERTYPE_TRAIL)
		ND_PRINT((ndo, "<wrong proto type>"));
	else if (PROTO_LEN(ap) != 4)
		ND_PRINT((ndo, "<wrong len>"));
	else
		ND_PRINT((ndo, "%s", ipaddr_string(ndo, TPA(ap))));
}

static void
spaddr_print_ip(netdissect_options *ndo,
	        const struct arp_pkthdr *ap, u_short pro)
{
	if (pro != ETHERTYPE_IP && pro != ETHERTYPE_TRAIL)
		ND_PRINT((ndo, "<wrong proto type>"));
	else if (PROTO_LEN(ap) != 4)
		ND_PRINT((ndo, "<wrong len>"));
	else
		ND_PRINT((ndo, "%s", ipaddr_string(ndo, SPA(ap))));
}

static void
atmarp_tpaddr_print(netdissect_options *ndo,
		    const struct atmarp_pkthdr *ap, u_short pro)
{
	if (pro != ETHERTYPE_IP && pro != ETHERTYPE_TRAIL)
		ND_PRINT((ndo, "<wrong proto type>"));
	else if (ATMTPROTO_LEN(ap) != 4)
		ND_PRINT((ndo, "<wrong tplen>"));
	else
		ND_PRINT((ndo, "%s", ipaddr_string(ndo, ATMTPA(ap))));
}

static void
atmarp_spaddr_print(netdissect_options *ndo,
		    const struct atmarp_pkthdr *ap, u_short pro)
{
	if (pro != ETHERTYPE_IP && pro != ETHERTYPE_TRAIL)
		ND_PRINT((ndo, "<wrong proto type>"));
	else if (ATMSPROTO_LEN(ap) != 4)
		ND_PRINT((ndo, "<wrong splen>"));
	else
		ND_PRINT((ndo, "%s", ipaddr_string(ndo, ATMSPA(ap))));
}

		ND_PRINT((ndo, "who-has "));
		atmarp_tpaddr_print(ndo, ap, pro);
		ND_PRINT((ndo, " tell "));
		atmarp_spaddr_print(ndo, ap, pro);
		atmarp_spaddr_print(ndo, ap, pro);
		ND_PRINT((ndo, " is-at "));
		ND_PRINT((ndo, "at "));
		atmarp_spaddr_print(ndo, ap, pro);
		ND_PRINT((ndo, "for "));
		atmarp_spaddr_print(ndo, ap, pro);
	if (!ND_TTEST2(*TPA(ap), PROTO_LEN(ap))) {
		ND_PRINT((ndo, "who-has "));
		tpaddr_print_ip(ndo, ap, pro);
		ND_PRINT((ndo, " tell "));
		spaddr_print_ip(ndo, ap, pro);
		spaddr_print_ip(ndo, ap, pro);
		ND_PRINT((ndo, " is-at %s",
		ND_PRINT((ndo, "%s at ",
			  linkaddr_string(ndo, THA(ap), linkaddr, HRD_LEN(ap))));
		tpaddr_print_ip(ndo, ap, pro);
		ND_PRINT((ndo,"%s at ",
			  linkaddr_string(ndo, SHA(ap), linkaddr, HRD_LEN(ap))));
		spaddr_print_ip(ndo, ap, pro);
getname_2_read4_asan	getname_2_read4_asan.pcap	getname_2_read4_asan.out	-v
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Unknown Hardware (37) (len 6), Unknown Protocol (0x0000) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:fa:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), 802.1Q-9200 (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:25:00 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x2500) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:59 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x4b00) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:25:00 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x3100) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Unknown Hardware (34) (len 6), Unknown Protocol (0x0849) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0841) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0xda00) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0xbc00) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:31 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x7a00) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:fb:ff:ff, ethertype ARP (0x0806), length 60: Unknown Hardware (37) (len 6), Unknown Protocol (0x0000) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:21:5a:21:9e:fd > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0854) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 12), Request who-has <wrong len> (01:01:00:00:00:00) tell <wrong len>, length 46
00:1f:39:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0801) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:78:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x08ae) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0801) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 0), Unknown Protocol (0x0825) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x2500) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 5), Request who-has <wrong len> (00:00:00:00:00:c0) tell <wrong len>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0880) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x2500) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 0), Unknown Protocol (0x0825) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 0), Unknown Protocol (0x0825) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x4800) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:13:20:13:db:6f > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0855) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0884) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x085a) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x08f3) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
10:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x080a) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0873) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x6800) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:2d:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0810) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Unknown Hardware (37) (len 6), Unknown Protocol (0x0000) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Unknown Hardware (37) (len 6), Unknown Protocol (0x0000) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:13:20:13:db:6f > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x084e) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
25:00:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 0), Unknown Protocol (0x0825) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0xd000) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:61:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0801) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x5700) (len 4), Request who-has <wrong proto type> (00:00:ab:00:00:00) tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x086d) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:21:d8:01:03:45 > 00:08:02:7e:b2:36, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x081a) (len 4), Reply <wrong proto type> is-at 00:21:d8:01:03:45, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0835) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0802) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:67:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0855) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0a00) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x2500) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0xf300) (len 4), Request who-has <wrong proto type> (58:00:00:00:00:00) tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > b2:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x4c00) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Unknown Hardware (37) (len 6), Unknown Protocol (0x0000) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0801) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0810) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0875) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x08b2) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0856) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x081e) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x4e00) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:99:79 > ff:ff:ff:ff:ff:7f, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x08b5) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0808) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
02:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0880) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x086a) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 0), Unknown Protocol (0x0825) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0870) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x5700) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0a00) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:21:d8:01:03:45 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x4800) (len 4), Request who-has <wrong proto type> (00:00:36:00:00:00) tell <wrong proto type>, length 46
00:21:d8:01:03:45 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x7100) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:21:d8:01:03:45 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0871) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x5800) (len 4), Request who-has <wrong proto type> (00:00:00:00:80:00) tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 12), Request who-has <wrong len> (01:01:00:00:00:00) tell <wrong len>, length 46
00:1f:29:da:2d:79 > ff:ff:7f:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0840) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0900) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0801) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:87:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0804) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0820) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0844) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:13:20:13:db:6f > ff:ff:71:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 0), Unknown Protocol (0x0825) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x2d00) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:13:20:13:db:6f > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0873) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x7000) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:13:20:13:db:6f > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x2800) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x6c00) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:4e:ff, ethertype ARP (0x0806), length 60: Unknown Hardware (50) (len 6), Unknown Protocol (0x0820) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0833) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:13:20:13:db:6f > ff:ff:ff:ff:ff:ba, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0870) (len 4), Request who-has <wrong proto type> (00:00:00:d0:00:00) tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 0), Unknown Protocol (0x0825) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x1f00) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0a00) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0900) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:3a:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0840) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0874) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0xce00) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:f9 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0xb200) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 0), Unknown Protocol (0x0825) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x2500) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:47:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0808) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x086f) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x0802) (len 4), Request who-has <wrong proto type> (00:6a:00:00:00:00) tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Ethernet (len 6), Unknown Protocol (0x082e) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
00:1f:29:da:2d:79 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 60: Unknown Hardware (37) (len 6), Unknown Protocol (0x0000) (len 4), Request who-has <wrong proto type> tell <wrong proto type>, length 46
ARP, Unknown Hardware (65280) (len 0), Unknown Protocol (0x8b01) (len 0), Reverse Reply <empty> at <wrong proto type>, length 65556