I have a wireshark capture that indicating a unicast ARP request from source to destination.
As per my understanding ARP requests (including gratutious ARP) use broadcast. In what case the unicast ARP request is used ?
asked Jul 21, 2012 at 9:39
-
Can you show the dump of the packet? Could this be a DHCPINFORM packet?– ott--Jul 21, 2012 at 10:44
-
@ott The link (wireshark capture PNG Image) I mentioned above includes the dump of the packet I am talking about– Lunar MushroomsJul 21, 2012 at 17:55
Add a comment
|
1 Answer
See RFC1122, section 2.3.2.1 - ARP Cache Validation:
IMPLEMENTATION: Four mechanisms have been used, sometimes in
combination, to flush out-of-date cache entries.[...]
(2) Unicast Poll -- Actively poll the remote host by periodically sending a point-to-point ARP Request to it, and delete the entry if no ARP Reply is received from N successive polls. Again, the
timeout should be on the order of a minute, and typically N is 2.
Also, arping is using unicast ARP requests to reduce the amount of broadcast traffic.
answered Jul 21, 2012 at 12:51
