I play with libpcap in C recently to create an arp sniffer program that captures arp requests on the air. I came up with a strange effect. I captured arp requests from my router. I don't know if this is a bug of my program, but I was curious (even more after I analyzed the packet and found that the operation code was set to 1 which means we have to do with arp request). Is this ever possible? I didn't found any entry for a similar question on the Internet.


ARP is used by a host on a LAN to resolve a layer-3 address to a layer-2 address so that a frame can be built for the LAN. A router is just another host on a LAN, and it will need to resolve layer-3 addresses to layer-2 addresses, the same way a PC on a LAN does.

  • I woudn't call a router a host (but I totally agree otherwise). – JeanPierre Dec 27 '16 at 19:40
  • 8
    In layer-2 (LAN) protocols, there are no routers, only hosts. – Ron Maupin Dec 27 '16 at 20:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy