Classify an ARP frame

Challenge

Read the opcode out of an ARP frame to tell a request from a reply — the first thing an ARP-spoofing detector classifies.

Task

Implement int arp_opcode(const uint8_t *frame, size_t n). The grader passes a static ARP frame buffer; no frames are sent.

Input

• frame: the ARP frame bytes (the harness supplies a fixed fixture).
• n: number of bytes available in frame.

The opcode is a big-endian 16-bit value at byte offset 6, i.e. (frame[6] << 8) | frame[7].

Output

Return 1 for an ARP request (opcode 1), 2 for an ARP reply (opcode 2). Return -1 for NULL frame, n < 8, or any other opcode value.

Example

{0,1,8,0,6,4,0,1}  ->  1   (request)
{0,1,8,0,6,4,0,2}  ->  2   (reply)
{0,1,8,0,6,4,0,9}  -> -1   (unknown opcode)
n = 7              -> -1   (too short)
NULL               -> -1

Edge cases

• Any opcode other than 1 or 2 returns -1.
• n < 8 (not enough bytes to reach the opcode) returns -1.

Why this matters

ARP request vs reply is the first thing an ARP-spoofing detector classifies. The opcode is two bytes at a fixed offset.

Input format

frame, the ARP frame bytes; n, the number of bytes available.

Output format

1 for request, 2 for reply, -1 for NULL, n<8, or any other opcode.

Constraints

Opcode is a big-endian u16 at offset 6; check n>=8 before reading.

Starter code

#include <stdint.h>
#include <stddef.h>
int arp_opcode(const uint8_t *frame, size_t n) {
    /* TODO */
    (void)frame; (void)n;
    return -1;
}

Common mistakes

Reading the wrong offset. Forgetting the n>=8 bound.

Edge cases to handle

Unknown opcode. Short buffer. NULL.

Complexity

O(1).

Background lessons

• Detecting port scans — flags and fan-out

Up next

• Classify a TCP scan from its flag byte