I have a wireshark capture that indicating a unicast ARP request from source to destination.

Wireshark screenshot

As per my understanding ARP requests (including gratutious ARP) use broadcast. In what case the unicast ARP request is used ?

  • Can you show the dump of the packet? Could this be a DHCPINFORM packet? – ott-- Jul 21 '12 at 10:44
  • @ott The link (wireshark capture PNG Image) I mentioned above includes the dump of the packet I am talking about – Lunar Mushrooms Jul 21 '12 at 17:55
up vote 10 down vote accepted

See RFC1122, section 2.3.2.1 - ARP Cache Validation:

IMPLEMENTATION: Four mechanisms have been used, sometimes in
combination, to flush out-of-date cache entries.

[...]

(2) Unicast Poll -- Actively poll the remote host by periodically sending a point-to-point ARP Request to it, and delete the entry if no ARP Reply is received from N successive polls. Again, the
timeout should be on the order of a minute, and typically N is 2.

Also, arping is using unicast ARP requests to reduce the amount of broadcast traffic.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.