Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a wireshark capture that indicating a unicast ARP request from source to destination.

Wireshark screenshot

As per my understanding ARP requests (including gratutious ARP) use broadcast. In what case the unicast ARP request is used ?

share|improve this question
Can you show the dump of the packet? Could this be a DHCPINFORM packet? – ott-- Jul 21 '12 at 10:44
@ott The link (wireshark capture PNG Image) I mentioned above includes the dump of the packet I am talking about – Lunar Mushrooms Jul 21 '12 at 17:55
up vote 8 down vote accepted

See RFC1122, section - ARP Cache Validation:

IMPLEMENTATION: Four mechanisms have been used, sometimes in
combination, to flush out-of-date cache entries.


(2) Unicast Poll -- Actively poll the remote host by periodically sending a point-to-point ARP Request to it, and delete the entry if no ARP Reply is received from N successive polls. Again, the
timeout should be on the order of a minute, and typically N is 2.

Also, arping is using unicast ARP requests to reduce the amount of broadcast traffic.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.