Module 2: Ethernet & ARP

Introduction & Learning Objectives

This is where the real fun begins — you're about to make your first actual network stack code come to life.

In the last module, you built a little virtual LAN where packets could move freely between two containers. Now, we're going to sneak inside one of those containers (the stack container) and take control of its network card — not the real one, but a pretend one that delivers raw Ethernet frames directly to your program.

Why Ethernet & ARP Matter

Every piece of Internet traffic — from a Google search to a game server ping — ultimately rides on top of Ethernet and ARP. These two protocols are the bedrock of everything else.

• Ethernet defines how data is wrapped and addressed inside a local network: who's sending, who's receiving, and what kind of data is inside.
• ARP (Address Resolution Protocol) is how machines learn each other's physical addresses (MACs) from logical ones (IP addresses).

You're going to build both.

The Magic Moment

By the end of this module, your code will do something magical:

When another machine asks,

"Who has 10.10.0.4?"

your program — not Linux — will reply,

"That's me! Here's my MAC address."

You'll be able to open Wireshark or tcpdump, watch those ARP requests and replies flying across your virtual wire, and know that every byte was assembled by your code.

Learning Objectives

By the end of Module 2, you will:

1. Understand what Ethernet frames and ARP packets look like on the wire.
2. Learn how TAP interfaces let user-space programs send and receive raw frames.
3. Write C code to open /dev/net/tun, create a TAP device, and bring it online.
4. Parse Ethernet headers and identify the payload type (IPv4, ARP, etc.).
5. Handle ARP requests and generate valid ARP replies from your own stack.
6. Verify everything works by successfully responding to an arping test.

This is your first real "layer" — the moment your stack takes its first breath on the network.