title: jNetPcap - Analysing ARP packets from a PCAP file
body: <p>I'm trying to obtain information on ARP packets within a PCAP file using the jNetPcap library for Java. What I'm really after is reading the Source and Destination addresses within the Ethernet frame, as well as the Sender MAC and Target MAC within the ARP packet.</p>
  
  <p>So far I've been able to load a PCAP file, loop through all the packets in the packet capture, and display the packet numbers (Frame Number) for those packets which are indeed of the ARP protocol.</p>
  
  <p>How do I obtain the additional information I'm after? </p>
  
  <p>Here's my code so far:</p>
  
  <pre><code>package firstjavapcaptest;
  
  import org.jnetpcap.Pcap;
  import org.jnetpcap.packet.PcapPacket;
  import org.jnetpcap.packet.PcapPacketHandler;
  import org.jnetpcap.protocol.lan.Ethernet;
  import org.jnetpcap.protocol.network.Arp;
  import org.jnetpcap.protocol.tcpip.Tcp;
  
  public class FirstJavaPcapTest {
  
      /**
       * @param args the command line arguments
       */
      public static void main(String[] args) {
          // TODO code application logic here
  
          final StringBuilder errbuf = new StringBuilder(); // for any error messages
          final String file = "Z:\\test_pcap.pcap";
          Tcp tcp = new Tcp(); // Preallocate a TCP header
          Arp arp = new Arp(); // Preallocate a ARP header
          System.out.printf("Opening file for reading: %s%n", file);  
  
          Pcap pcap = Pcap.openOffline(file, errbuf);  
          if (pcap == null) {  
              System.err.printf("Error while opening device for capture: " + errbuf.toString());  
              return;  
          }  
  
          PcapPacketHandler&lt;String&gt; jphArp = new PcapPacketHandler&lt;String&gt;() { 
              public void nextPacket(PcapPacket packet, String user) {
                  Ethernet ethh  = new Ethernet();
                  if (packet.hasHeader(arp)) {
                      System.out.println("[" + packet.getFrameNumber() + "]");
                  }
              }
          };
  
          try {  
              pcap.loop(-1, jphArp, "");
          } finally {  
              pcap.close();  
          }
      }
  
  }
  </code></pre>