Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to understand ARP and ARP cache poisoning. Will a host updates its cache if it gets an ARP response even if it didnt send a request? If yes, is there any particular reason it is designed like that?

Also I have one more question. In case of ARP cache poisoning, does the malicious host flood the network with ARP responses or respond only when some one sends out a request

share|improve this question
It depends on the device / OS. Some switches will do, some OSes will filter packet on the firewall before it's even examined by the system. – Andrew Smith Jul 6 '12 at 9:45
up vote 2 down vote accepted

Most of the time, a device will accept unsolicited ARP replies, to allow machines to notify others when the MAC address for an IP address changes. The methods of ARP cache poisoning are varied, but typically you don't have to flood the network, just send them periodically to ensure that the ARP cache doesn't expire and the other machine does an ARP request of it's own.

share|improve this answer

Will a host updates its cache if it gets an ARP response even if it didnt send a request? If yes, is there any particular reason it is designed like that?

Yes. THe idea is that for example a workstation picks up all addresses of servers even if not needing them at the moment. Especially the AP address of the gatedway of the network and local switches. This reduces network traffic in a pre-switch era because a workstation gets all that when someone ele asks. The idea is that your local broadcast domain is trusted anyway, so poisoning is not an issue, and it reduces traffic as the answer is going to be valid anyway. The trust assumption is true in any corporate network - mostly- but obviously breaks apart in hosting centers, for example.

share|improve this answer
But isnt ARP Response a unicast and sent to only the one who requests. In that case, how a work station is expected to pickup addresses of other devices which it may be needing future? – user1004985 Jul 6 '12 at 10:05
Ah, but when ARP Was designed, noone had a switch (not sure they even ecisted). A Hub sends all packets to everyone ;) Today, yes, it makes little sense - in a Hub world 20 years and more ago, it was a significant saving. – TomTom Jul 6 '12 at 10:07
@Tomtom, a hub has nothing to do with it. There are two conditions for a station to update its arp cache: 1) ARP dmac is unicast to the station in question. 2) ARP dmac is a broadcast address. If you have a 10 stations on a hub and a unicast ARP reply is sent, only the station addressed in the reply will update their cache. – Mike Pennington Jul 6 '12 at 10:43
@tomtom I have to agree with MikePennington on this one. Your PC is picking up other MAC addresses from servers and workstations that are sending broadcast/multicast packets. ARP replies are unicast. ARP poisoning works by sending ARP replies to either the unicast or the broadcast address for specific MAC/IP combinations. In today's world and in days of yore a PC will have the same entries in it's ARP cache regardless of it being connected to a hub or switch. Quite the harsh response I might add. – Paul Ackerman Jul 6 '12 at 11:47
@tomtom, please calm down. Remember, I said ARP replies are unicast. I did not discuss ARPs bound to multicast mac-addresses (not commonly seen, but used by some clustering technologies), and I did not mention ARP requests (which are broadcast and may populate an ARP cache, unsolicited) – Mike Pennington Jul 6 '12 at 11:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.