NEMESIS-ARP(1)							NEMESIS-ARP(1)



NAME
       nemesis-arp - ARP/RARP Protocol (The Nemesis Project)

SYNOPSIS
       nemesis-arp [-rsTRvZ?] [-d Ethernet-device ] [-D destination-IP-address
       ] [-h sender-hardware-address ] [-H source-MAC-address  ]  [-m  target-
       hardware-address ] [-M destination-MAC-address ] [-P payload-file ] [-S
       source IP address ]

DESCRIPTION
       The Nemesis Project is designed to be a	command	 line-based,  portable
       human  IP stack for UNIX-like and Windows systems.  The suite is broken
       down by protocol, and should allow for  useful  scripting  of  injected
       packets from simple shell scripts.

       nemesis-arp provides an interface to craft and inject ARP frames allow-
       ing the user to specify any portion of an ARP frame.

ARP/RARP OPTIONS
       -D destination-IP-address
	      Specify the destination-IP-address of the injected ARP frame.

       -h sender-hardware-address
	      Specify the sender-hardware-address within the ARP frame only.

       -m sender-hardware-address
	      Specify the target-hardware-address within the ARP frame only.

       -P payload-file
	      This will cause nemesis-arp to use the specified payload-file as
	      the payload when injecting ARP/RARP frames.  The maximum payload
	      size is 1472 bytes in order to account for the maximum  Ethernet
	      frame  size.  Payloads can also be read from stdin by specifying
	      '-P -' instead of a payload-file.

       -r reply-enable
	      Enables ARP/RARP replies.

       -R RARP-Enable
	      Enables RARP mode.

       -s Solaris-mode-enable
	      When performing ARP requests, rather than zero out  the  6  byte
	      target hardware address field within the ARP frame, Solaris sys-
	      tems copy the target hardware address from the  Ethernet	header
	      into  this  field.  This option emulates Solaris systems by set-
	      ting  the	 target	 hardware  address   within   ARP   frame   to
	      ff:ff:ff:ff:ff:ff rather than the standard 00:00:00:00:00:00.

       -S source-IP-address
	      Specify the source-IP-address of the injected ARP frame.

       -v verbose-mode
	      Display  the  injected packet in human readable form.  Use twice
	      to see a hexdump of the injected	packet	with  printable	 ASCII
	      characters  on the right.	 Use three times for a hexdump without
	      decoded ASCII.

DATA LINK OPTIONS
       -d Ethernet-device
	      Specify the name (for UNIX-like systems) or the number (for Win-
	      dows  systems)  of  the  Ethernet-device to use (eg. fxp0, eth0,
	      hme0, 1).

       -H source-MAC-address
	      Specify the source-MAC-address (XX:XX:XX:XX:XX:XX).

       -M destination-MAC-address
	      Specify the destintion-MAC-address (XX:XX:XX:XX:XX:XX).

       -Z list-network-interfaces
	      Lists the available network interfaces  by  number  for  use  in
	      link-layer injection.

	      NOTE: This feature is only relevant to Windows systems.

DIAGNOSTICS
       Nemesis-arp  returns 0 on a successful exit, 1 if it exits on an error.

BUGS
       Send concise and clearly written bug reports to jeff@snort.org

AUTHOR
       Jeff Nathan <jeff@snort.org>

       Originally developed by Mark Grimes <mark@stateful.net>

SEE ALSO
       nemesis-dns(1), nemesis-ethernet(1), nemesis-icmp(1),  nemesis-igmp(1),
       nemesis-ip(1),  nemesis-ospf(1),	 nemesis-rip(1), nemesis-tcp(1), neme-
       sis-udp(1)



				  16 May 2003			NEMESIS-ARP(1)
