6

I would like to ask, with ARP request I got to believe that the destination MAC address was in all situations a broadcast address. Yet I got across a wireshark capture: ARP wireshark capture

I just cannot understand the 3rd request from my router. Why is the destination MAC address of the request set to my NIC and not as broadcast? The last ARP request from the router is exactly how I would assume it to be (i.e. MAC is a broadcast).

( .1 is a router, .100 my PC, .103 second PC )

  • What is the router model, software version, etc.? – Ron Maupin Mar 17 '16 at 19:38
  • The router is unfortunately not "under my control" so I cannot get the info. I thought it was directly a feature of ARP and the model of the router did not matter. Will try to obtain it in the near future. – PesaThe Mar 17 '16 at 19:48
  • Questions about networks not under your control are explicitly off-topic here. The help center details which topics are on-topic, and which topics are off-topic. You can try to ask this question on Super User. – Ron Maupin Mar 17 '16 at 19:55
  • I issued a question about ARP, did not know those information would be required for this kind of question, my apologies. Will try what you suggested. – PesaThe Mar 17 '16 at 19:56
  • Just want to ask additional question if possible. Does that mean it's not a regular behavior of ARP and it probably depends on the model of the router? – PesaThe Mar 17 '16 at 20:21
10

In an attempt to refresh an expired, or expiring, ARP entry, many Client OS's will issue a "targeted" ARP query to the MAC address they already expect. Most of the time, this prompts a response from the intended target and allows the entry to be refreshed without sending a broadcast to the entire network.

This will be the first time I've seen it with a Router, but it isn't too big of a stretch to think a Router vendor somewhere will have implemented ARP in the same way.

Nearly a Year Later Edit: I found a quote in RFC 1122 that describes this behavior:

2.3.2  Address Resolution Protocol -- ARP
   2.3.2.1  ARP Cache Validation
      An implementation of the Address Resolution Protocol (ARP)
      MUST provide a mechanism to flush out-of-date cache
      entries.  If this mechanism involves a timeout, it SHOULD be

      ...

      IMPLEMENTATION:
           Four mechanisms have been used, sometimes in
           combination, to flush out-of-date cache entries.

           ...

           (2)  Unicast Poll -- Actively poll the remote host by
                periodically sending a point-to-point ARP Request
                to it, and delete the entry if no ARP Reply is
                received from N successive polls.  Again, the
                timeout should be on the order of a minute, and
                typically N is 2.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.