I have a wireshark capture that indicating a unicast ARP request from source to destination.

Wireshark screenshot

As per my understanding ARP requests (including gratutious ARP) use broadcast. In what case the unicast ARP request is used ?

  • Can you show the dump of the packet? Could this be a DHCPINFORM packet?
    – ott--
    Jul 21, 2012 at 10:44
  • @ott The link (wireshark capture PNG Image) I mentioned above includes the dump of the packet I am talking about Jul 21, 2012 at 17:55

1 Answer 1


See RFC1122, section - ARP Cache Validation:

IMPLEMENTATION: Four mechanisms have been used, sometimes in
combination, to flush out-of-date cache entries.


(2) Unicast Poll -- Actively poll the remote host by periodically sending a point-to-point ARP Request to it, and delete the entry if no ARP Reply is received from N successive polls. Again, the
timeout should be on the order of a minute, and typically N is 2.

Also, arping is using unicast ARP requests to reduce the amount of broadcast traffic.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .