


NEMESIS-ARP(1)					   NEMESIS-ARP(1)


NAME
       nemesis-arp - ARP/RARP Protocol (The Nemesis Project)

SYNOPSIS
       nemesis-arp  [-rsTRvZ?] [-d Ethernet-device ] [-D destina-
       tion-IP-address	]  [-h	sender-hardware-address	  ]   [-H
       source-MAC-address  ]  [-m  target-hardware-address  ] [-M
       destination-MAC-address ] [-P payload-file ] [-S source IP
       address ]

DESCRIPTION
       The  Nemesis  Project  is  designed  to be a command line-
       based, portable human IP stack for UNIX-like  and  Windows
       systems.	 The suite is broken down by protocol, and should
       allow for useful scripting of injected packets from simple
       shell scripts.

       nemesis-arp  provides an interface to craft and inject ARP
       frames allowing the user to specify any portion of an  ARP
       frame.

ARP/RARP OPTIONS
       -D destination-IP-address
	      Specify  the destination-IP-address of the injected
	      ARP frame.

       -h sender-hardware-address
	      Specify the sender-hardware-address within the  ARP
	      frame only.

       -m sender-hardware-address
	      Specify  the target-hardware-address within the ARP
	      frame only.

       -P payload-file
	      This will cause nemesis-arp to  use  the	specified
	      payload-file as the payload when injecting ARP/RARP
	      frames.  The maximum payload size is 1472 bytes  in
	      order  to	 account  for  the maximum Ethernet frame
	      size.  Payloads can also	be  read  from	stdin  by
	      specifying '-P -' instead of a payload-file.

       -r reply-enable
	      Enables ARP/RARP replies.

       -R RARP-Enable
	      Enables RARP mode.

       -s Solaris-mode-enable
	      When  performing ARP requests, rather than zero out
	      the 6 byte target hardware address field within the
	      ARP frame, Solaris systems copy the target hardware
	      address from the Ethernet header into  this  field.
	      This option emulates Solaris systems by setting the



			   16 May 2003				1





NEMESIS-ARP(1)					   NEMESIS-ARP(1)


	      target  hardware	address	 within	 ARP   frame   to
	      ff:ff:ff:ff:ff:ff	   rather   than   the	 standard
	      00:00:00:00:00:00.

       -S source-IP-address
	      Specify the source-IP-address of the  injected  ARP
	      frame.

       -v verbose-mode
	      Display the injected packet in human readable form.
	      Use twice to see a hexdump of the injected  packet.

DATA LINK OPTIONS
       -d Ethernet-device
	      Specify  the  name  (for	UNIX-like systems) or the
	      number (for Windows systems) of the Ethernet-device
	      to use (eg. fxp0, eth0, hme0, 1).

       -H source-MAC-address
	      Specify the source-MAC-address (XX:XX:XX:XX:XX:XX).

       -M destination-MAC-address
	      Specify	      the	   destintion-MAC-address
	      (XX:XX:XX:XX:XX:XX).

       -Z list-network-interfaces
	      Lists  the  available  network interfaces by number
	      for use in link-layer injection.

	      NOTE: This feature is only relevant to Windows sys-
	      tems.

DIAGNOSTICS
       Nemesis-arp  returns 0 on a successful exit, 1 if it exits
       on an error.

BUGS
       Send  concise  and  clearly   written   bug   reports   to
       jeff@snort.org

AUTHOR
       Jeff Nathan <jeff@snort.org>

       Originally developed by Mark Grimes <mark@stateful.net>

SEE ALSO
       nemesis-dns(1),	  nemesis-ethernet(1),	 nemesis-icmp(1),
       nemesis-igmp(1), nemesis-ip(1), nemesis-ospf(1),	 nemesis-
       rip(1), nemesis-tcp(1), nemesis-udp(1)








			   16 May 2003				2


