Please help me to understand this behavior of one of my networking devices. It sends the ARP request broadcast with the source IP: . I am only aware about being used in "ARP Probes" where the Device should be sending :-

"who has MY-IP Please tell"

as the device wants to make sure no other device in the subnet has the same IP so to avoid IP conflict.

But in my case Device sends the ARP request broadcast(not an ARP probe because ARP probe should have asked for it's own IP) as

"who has DeviceX's-IP please tell" .

The device has an IP configured as, so in that case I would have expected it to send a request of the form :-

"who has DeviceX's-IP Please tell".

Consequently Device X should reply from which will get its MAC address,the basic arp stuff but this "" is out of my understanding.

Thank you

2 Answers 2


That is a standard ARP probe (RFC 5227) - a node requests an ARP resolution for the address it intends to use (and expects no reply).

ARP works on top of layer 2 (Ethernet) and does not use a standard IP packet. Accordingly, any node answering to an ARP request doesn't reply to the Sender Protocol Address (SPA) but to the Sender Hardware Address (SHA).

An ARP probe uses the all-zero sender's address to avoid trashing the other nodes' ARP caches.

  • thank you for the reply but I believe this is not a standard ARP probe because it should ask for its own IP not someone else's. As I mentioned:- Standard ARP Probe:- who has please tell here =its own ip. My case:- who has "DeviceXYZ IP" please tell
    – nowiz
    May 10, 2018 at 19:57
  • 1
    I guess there's a misconception: ARP works over L2 only, the reply is always sent to the Sender Hardware Address (SHA). The Sender Protocol Address (SPA) isn't actually used and is just informational (like updating the local ARP cache). An ARP probe explicitly uses as SPA.
    – Zac67
    May 11, 2018 at 6:31
  • I've also seen this osqa-ask.wireshark.org/questions/5178/… May 29, 2021 at 2:36

These ARPs are used for Duplicate Address Detection (DAD).

This is common when a DHCP client receives an offer from a DHCP server.

From the DHCP RFC: RFC 2131 Section 4.4.1

The client SHOULD perform a check on the suggested address to ensure
that the address is not already in use.  For example, if the client is
on a network that supports ARP, the client may issue an ARP request for 
the suggested request.  When broadcasting an ARP request for the 
suggested address, the client must fill in its own hardware address as 
the sender's hardware address, and 0 as the sender's IP address, to 
avoid confusing ARP caches in other hosts on the same subnet.

Some operating systems also send these gratuitous ARPs to detect duplicate addresses when statically configured. The operation is OS dependent. This article is a few years old but discusses the behaviour on several versions of Windows.

In address conflict detection, we use what is known as a Gratuitous ARP. 
When a system is configured with an IP address either manually or by 
DHCP it will send a Gratuitous ARP to insure that another node on the 
network is not already configured with this IP address.

The article continued to describe the operation in older versions of the operating system:

In Windows XP and Windows Server 2003 the Gratuitous ARP request is sent 
with the Senders MAC filled in with the MAC of the sending system and 
the Target MAC set to 0’s, but the Senders and Target IP address are 
both set to the address of the sending system. If a conflict is detected 
then the defending system replies with its IP and MAC address.

The article then states that the behaviour was changed in later versions of Windows.

Additionally, when a gratuitous ARP is sent by a Windows Vista or
Windows Server 2008, the following change has been made –  the SPA field 
in the initial request is set to This way the ARP or neighbor 
caches of systems receiving this request are not updated. So, if there 
is a duplicate IP address, the receivers do not need to have their cache 
  • The device in question is statically configured not by DHCP.
    – Zac67
    May 11, 2018 at 6:35
  • @Zac67, it's still DAD. I'll add more to the answer. May 11, 2018 at 6:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.