2
  1. I assume that the source and destination IP addresses are the same, so the if there is another host on the network which uses the same IP will reply and the computer will know that there is a conflict with the IP addresses. Is it a correct assumption?
  2. I don't understand the other use of the GARP - When can a change in the MAC address occur on a network that initiates the GARP broadcast to update the arp tables?
  • Someone can add a concise answer, but this is a nifty page. wiki.wireshark.org/Gratuitous_ARP – Jordan Head Feb 15 '15 at 8:15
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 4:24
2
  1. RFC 5227 defines duplicate address detection on IPv4 using ARP. If you start a packet capture on a Windows host and then configure a new IP address you'll see this in the capture:

The host sends 3 ARP requests. These requests will ask about its own IP (as you've correctly assumed), but will present himself as 0.0.0.0 so other hosts don't log its IP address yet. If there's no reply after those 3 requests, it will send a GARP packet effectively updating everyone else in the network*.

  1. A GARP packet is sent from your MAC address to Broadcast (ff:ff:ff:ff:ff:ff), stating which one is your IP address. That's how the other hosts learn your MAC address. Depending on the OS some devices will cache that information for several minutes, so if you happen to change your IP by any reason you'll want to send a GARP to immediately update that. A very common reason to send GARP is when there's a failover in an active/passive HA pair. Especially if that HA pair is a pair of firewalls and your network's gateway. The new firewall will be the active and it needs to tell everyone where to send the packets now. This is just one of the several approaches to high availability, other vendors fake a common MAC address so there are no GARP packets involved.

For security reasons, not every device will accept GARP for the gateway's IP address from the network if they already have an entry. In my experience this is the case with Cisco IP phones. Had a hard time with them and a pair of Checkpoint firewalls running ClusterXL.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.