GratuitousARPMessages

The term ‘Gratuitous ARP’ is used for both GratuitousARPRequest and GratuitousARPReply

It’s ambiguous in more ways than one - see GratuitousARPAmbiguousTerminology

This is a host telling the network about its own address. Requests and replies both. See GratuitousRequestsVsReplies

GratuitousARPWithUnicastTargetMAC

ARPAnnouncement is the name RFC5227 gives GratuitousARPRequest when used in the context of ARPDuplicateAddressDetection @ref

Profiles of the packet is as follows:

• Sent as a broadcast (Ethernet dst is set to ff:ff:ff:ff:ff:ff), as a way for a node to announce or update its IP to MAC mapping to the entire network @ref

• Can also be sent unicast as indicated by the UnicastGratuitousARP* topic shapes below

• Sender MAC and Sender IP are the MAC and IP of the host sending the packet. This is the info the message is advertising. @ref

• Target MAC value is not relevant @ref

• Target MAC is usually ff:ff:ff:ff:ff:ff @ref

• Target MAC can be 00:00:00:00:00:00 @ref

• Target MAC can be even be unicast

• Sender MAC and Sender IP create a complete mapping so it will trigger ARPCache updates @ref

• An ARPProbe, by contrast, deliberately carries no complete mapping, so updates no cache @ref

What it’s used for can’t be read off the packet:

• ARPAnnouncement, as part of ARPDuplicateAddressDetection

• BroadcastTraffic on a network when a host changes its IP so other hosts can update their ARPCache

• Sent by some OperatingSystems on startup and to help with LoadBalancing

• Failover setups, where an address moves to another card or box

• ARPSpoofing and ARPCachePoisoning

• Shapes:

  • GratuitousARPReply
  • GratuitousARPReplySenderMACMismatch
  • GratuitousARPRequest
  • GratuitousARPRequestSenderMACMismatch
  • UnicastGratuitousARPReply
  • UnicastGratuitousARPReplySenderMACMismatch
  • UnicastGratuitousARPRequest
  • UnicastGratuitousARPRequestSenderMACMismatch