学步园

#define NUD_INCOMPLETE     0x01       一个请求已发送出去，但还没收到应答，在这个状态不使用任何硬件地址
#define NUD_REACHABLE     0x02         邻居的地址被放入缓存，并且知道该邻居是可到达的

#define NUD_STALE     0x04                
#define NUD_DELAY     0x08
#define NUD_PROBE     0x10            这三个用于状态转换阶段，当本地主机确定邻居是否可到达时，状态会发生改变   

#define NUD_FAILED     0x20            由于请求失败，将邻居标记为不可达

/* Dummy states */
#define NUD_NOARP     0x40                 用于标记不要任何协议进行L3到L2的地址映射的邻居
#define NUD_PERMANENT     0x80         邻居的L2地址是静态配置，因此不需要邻居协议进行地址解析
#define NUD_NONE     0x00                   邻居项刚被创建，还没有状态可用

NUD_IN_TIMER ：               当某一邻居项的状态不是很清晰时，邻居子系统就为其运行一个定时器

#define NUD_IN_TIMER     (NUD_INCOMPLETE|NUD_REACHABLE|NUD_DELAY|NUD_PROBE)

   
#define NUD_VALID     (NUD_PERMANENT|NUD_NOARP|NUD_REACHABLE|NUD_PROBE|NUD_STALE|NUD_DELAY)

NUD_CONNECTED  ：      这个状态为NUD_VALID的子状态，没有未决的确认要处理

#define NUD_CONNECTED     (NUD_PERMANENT|NUD_NOARP|NUD_REACHABLE)

int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
{
     int rc;
     unsigned long now;

     write_lock_bh(&neigh->lock);

     rc = 0;
     if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
          goto out_unlock_bh;

     now = jiffies;

     if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
          if (neigh->parms->mcast_probes + neigh->parms->app_probes) {                  .mcast_probes = 3,
               atomic_set(&neigh->probes, neigh->parms->ucast_probes);    重发arp请求的次数 .ucast_probes =  3,
               neigh->nud_state     = NUD_INCOMPLETE;    设状态为NUD_INCOMPLETE,
                neigh->updated = jiffies;
               neigh_add_timer(neigh, now + 1);                  且设置定时器
          } else {
               neigh->nud_state = NUD_FAILED;
               neigh->updated = jiffies;
               write_unlock_bh(&neigh->lock);

               kfree_skb(skb);
               return 1;
          }
     } else if (neigh->nud_state & NUD_STALE) {
          NEIGH_PRINTK2("neigh %p is delayed.\n", neigh);
          neigh->nud_state = NUD_DELAY;
          neigh->updated = jiffies;
          neigh_add_timer(neigh,
                    jiffies + neigh->parms->delay_probe_time);
     }

     if (neigh->nud_state == NUD_INCOMPLETE) {          如果是NUD_INCOMPLETE状态
          if (skb) {
     if (skb_queue_len(&neigh->arp_queue) >=检查队列长度，应该是每个邻居项都有一个可供缓存待解析的skb
                   neigh->parms->queue_len) {            .queue_len =          3,
                    struct sk_buff *buff;
                    buff = __skb_dequeue(&neigh->arp_queue);
                    kfree_skb(buff);                             取出一个  释放掉     
                    NEIGH_CACHE_STAT_INC(neigh->tbl, unres_discards);
               }
               __skb_queue_tail(&neigh->arp_queue, skb);     把这个新的放进去
          }
          rc = 1;
     }
out_unlock_bh:
     write_unlock_bh(&neigh->lock);
     return rc;
}

     大概看了看，都是定时器到期后处理各种状态迁移，找到我们分析的状态

     if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
          struct sk_buff *skb = skb_peek(&neigh->arp_queue);
          /* keep skb alive even if arp_queue overflows */
          if (skb)
               skb = skb_copy(skb, GFP_ATOMIC);
          write_unlock(&neigh->lock);
          neigh->ops->solicit(neigh, skb);               在arp_constructor()中被置上
          atomic_inc(&neigh->probes);
          kfree_skb(skb);

---

static const struct neigh_ops arp_hh_ops = {
     .family =          AF_INET,
     .solicit =          arp_solicit,
     .error_report =          arp_error_report,
     .output =          neigh_resolve_output,
     .connected_output =     neigh_resolve_output,
     .hh_output =          dev_queue_xmit,
     .queue_xmit =          dev_queue_xmit,
};

通过arp_send发送ARP REQUEST报文

static int arp_rcv(struct sk_buff *skb, struct net_device *dev,
             struct packet_type *pt, struct net_device *orig_dev)
{
     struct arphdr *arp;

     /* ARP header, plus 2 device addresses, plus 2 IP addresses.  */
     if (!pskb_may_pull(skb, arp_hdr_len(dev)))
          goto freeskb;

     arp = arp_hdr(skb);
     if (arp->ar_hln != dev->addr_len ||
         dev->flags & IFF_NOARP ||
         skb->pkt_type == PACKET_OTHERHOST ||
         skb->pkt_type == PACKET_LOOPBACK ||
         arp->ar_pln != 4)
          goto freeskb;

     if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
          goto out_of_mem;                                                                     一系列的合法性检查

     memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));  这里把skb的cb区域用作neighbour_cb结构空间

     return NF_HOOK(NFPROTO_ARP, NF_ARP_IN, skb, dev, NULL, arp_process);

freeskb:
     kfree_skb(skb);
out_of_mem:
     return 0;
}     

---

struct arphdr          arp头结构
{
     __be16          ar_hrd;       硬件地址格式
     __be16          ar_pro;        协议地址格式
     unsigned char     ar_hln;      硬件地址长度
     unsigned char     ar_pln;     协议地址长度
     __be16          ar_op;         命令代码

#if 0
     /*
       *     Ethernet looks like this : This bit is variable sized however...
       */
     unsigned char          ar_sha[ETH_ALEN];     /* sender hardware address     */
     unsigned char          ar_sip[4];          /* sender IP address          */
     unsigned char          ar_tha[ETH_ALEN];     /* target hardware address     */
     unsigned char          ar_tip[4];          /* target IP address          */
#endif

};

     ->arp = arp_hdr(skb);  获得ARP头

     ->if (arp->ar_op != htons(ARPOP_REPLY) &&arp->ar_op != htons(ARPOP_REQUEST))   

     

     ->

     if (ipv4_is_loopback(tip) || ipv4_is_multicast(tip))    环回或多播