Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a wireshark capture that indicating a unicast ARP request from source to destination.

Wireshark screenshot

As per my understanding ARP requests (including gratutious ARP) use broadcast. In what case the unicast ARP request is used ?

share|improve this question
    
Can you show the dump of the packet? Could this be a DHCPINFORM packet? –  ott-- Jul 21 '12 at 10:44
    
@ott The link (wireshark capture PNG Image) I mentioned above includes the dump of the packet I am talking about –  Lunar Mushrooms Jul 21 '12 at 17:55

1 Answer 1

up vote 6 down vote accepted

See RFC1122, section 2.3.2.1 - ARP Cache Validation:

IMPLEMENTATION: Four mechanisms have been used, sometimes in
combination, to flush out-of-date cache entries.

[...]

(2) Unicast Poll -- Actively poll the remote host by periodically sending a point-to-point ARP Request to it, and delete the entry if no ARP Reply is received from N successive polls. Again, the
timeout should be on the order of a minute, and typically N is 2.

Also, arping is using unicast ARP requests to reduce the amount of broadcast traffic.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.