In the Decoding Ethernet headers recipe, we created the got_packet() callback function that libpcap called for each packet that was captured. In this function, we learned how to pull out the Ethernet header information from the packet and created a switch statement that switched on the protocol type. In that switch statement, we made a reference to the decodeArp() function that is used to decode the ARP headers. In this recipe, we will create that decodeArp() function.

The ARP header is a part of the second layer (Internet layer) of our header stack. Its structure is shown in the following diagram:

Let's take a look at the fields of the ARP header: