I have a wireshark capture that indicating a unicast ARP request from source to destination.
As per my understanding ARP requests (including gratutious ARP) use broadcast. In what case the unicast ARP request is used ?
See RFC1122, section 22.214.171.124 - ARP Cache Validation:
IMPLEMENTATION: Four mechanisms have been used, sometimes in
combination, to flush out-of-date cache entries.
(2) Unicast Poll -- Actively poll the remote host by periodically sending a point-to-point ARP Request to it, and delete the entry if no ARP Reply is received from N successive polls. Again, the
timeout should be on the order of a minute, and typically N is 2.
arping is using unicast ARP requests to reduce the amount of broadcast traffic.