I have a wireshark capture that indicating a unicast ARP request from source to destination.
As per my understanding ARP requests (including gratutious ARP) use broadcast. In what case the unicast ARP request is used ?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
See RFC1122, section 188.8.131.52 - ARP Cache Validation:
IMPLEMENTATION: Four mechanisms have been used, sometimes in
combination, to flush out-of-date cache entries.
(2) Unicast Poll -- Actively poll the remote host by periodically sending a point-to-point ARP Request to it, and delete the entry if no ARP Reply is received from N successive polls. Again, the
timeout should be on the order of a minute, and typically N is 2.
arping is using unicast ARP requests to reduce the amount of broadcast traffic.