9

Regarding ARP requests, I got to believe that the destination MAC address was in all situations the broadcast address.

Yet I got across this Wireshark capture:

ARP wireshark capture

I just cannot understand the 3rd request from my router. Why is the destination MAC address of the request set to my NIC and not as broadcast? The last ARP request from the router is exactly how I would assume it to be (i.e., using the broadcast MAC address)

(.1 is a router, .100 my PC, .103 second PC)

Improve this question
6
  • What is the router model, software version, etc.?
    – Ron Maupin ♦
    Mar 17, 2016 at 19:38
  • The router is unfortunately not "under my control" so I cannot get the info. I thought it was directly a feature of ARP and the model of the router did not matter. Will try to obtain it in the near future.
    – PesaThe
    Mar 17, 2016 at 19:48
  • Questions about networks not under your control are explicitly off-topic here. The help center details which topics are on-topic, and which topics are off-topic. You can try to ask this question on Super User.
    – Ron Maupin ♦
    Mar 17, 2016 at 19:55
  • I issued a question about ARP, did not know those information would be required for this kind of question, my apologies. Will try what you suggested.
    – PesaThe
    Mar 17, 2016 at 19:56
  • Just want to ask additional question if possible. Does that mean it's not a regular behavior of ARP and it probably depends on the model of the router?
    – PesaThe
    Mar 17, 2016 at 20:21

1 Answer 1

Reset to default
14

In an attempt to refresh an expired, or expiring, ARP entry, many Client OS's will issue a "targeted" ARP query to the MAC address they already expect. Most of the time, this prompts a response from the intended target and allows the entry to be refreshed without sending a broadcast to the entire network.

This will be the first time I've seen it with a Router, but it isn't too big of a stretch to think a Router vendor somewhere will have implemented ARP in the same way.

Nearly a Year Later Edit: I found a quote in RFC 1122 that describes this behavior:

2.3.2  Address Resolution Protocol -- ARP
   2.3.2.1  ARP Cache Validation
      An implementation of the Address Resolution Protocol (ARP)
      MUST provide a mechanism to flush out-of-date cache
      entries.  If this mechanism involves a timeout, it SHOULD be

      ...

      IMPLEMENTATION:
           Four mechanisms have been used, sometimes in
           combination, to flush out-of-date cache entries.

           ...

           (2)  Unicast Poll -- Actively poll the remote host by
                periodically sending a point-to-point ARP Request
                to it, and delete the entry if no ARP Reply is
                received from N successive polls.  Again, the
                timeout should be on the order of a minute, and
                typically N is 2.
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.