Network Device sending ARP request (opcode 1) but with Source IP 0.0.0.0

Question

Please help me to understand this behavior of one of my networking devices. It sends the ARP request broadcast with the source IP:0.0.0.0 . I am only aware about 0.0.0.0 being used in "ARP Probes" where the Device should be sending :-

"who has MY-IP Please tell 0.0.0.0"

as the device wants to make sure no other device in the subnet has the same IP so to avoid IP conflict.

But in my case Device sends the ARP request broadcast(not an ARP probe because ARP probe should have asked for it's own IP) as

"who has DeviceX's-IP please tell 0.0.0.0" .

The device has an IP configured as 10.192.34.4, so in that case I would have expected it to send a request of the form :-

"who has DeviceX's-IP Please tell 10.192.34.4".

Consequently Device X should reply from which 10.192.34.4 will get its MAC address,the basic arp stuff but this "0.0.0.0" is out of my understanding.

Thank you

Answer 1

That is a standard ARP probe (RFC 5227) - a node requests an ARP resolution for the address it intends to use (and expects no reply).

ARP works on top of layer 2 (Ethernet) and does not use a standard IP packet. Accordingly, any node answering to an ARP request doesn't reply to the Sender Protocol Address (SPA) but to the Sender Hardware Address (SHA).

An ARP probe uses the all-zero sender's address 0.0.0.0 to avoid trashing the other nodes' ARP caches.

Answer 2

These ARPs are used for Duplicate Address Detection (DAD).

This is common when a DHCP client receives an offer from a DHCP server.

From the DHCP RFC: RFC 2131 Section 4.4.1

The client SHOULD perform a check on the suggested address to ensure
that the address is not already in use.  For example, if the client is
on a network that supports ARP, the client may issue an ARP request for 
the suggested request.  When broadcasting an ARP request for the 
suggested address, the client must fill in its own hardware address as 
the sender's hardware address, and 0 as the sender's IP address, to 
avoid confusing ARP caches in other hosts on the same subnet.

Some operating systems also send these gratuitous ARPs to detect duplicate addresses when statically configured. The operation is OS dependent. This article is a few years old but discusses the behaviour on several versions of Windows.

In address conflict detection, we use what is known as a Gratuitous ARP. 
When a system is configured with an IP address either manually or by 
DHCP it will send a Gratuitous ARP to insure that another node on the 
network is not already configured with this IP address.

The article continued to describe the operation in older versions of the operating system:

In Windows XP and Windows Server 2003 the Gratuitous ARP request is sent 
with the Senders MAC filled in with the MAC of the sending system and 
the Target MAC set to 0’s, but the Senders and Target IP address are 
both set to the address of the sending system. If a conflict is detected 
then the defending system replies with its IP and MAC address.

The article then states that the behaviour was changed in later versions of Windows.

Additionally, when a gratuitous ARP is sent by a Windows Vista or
Windows Server 2008, the following change has been made –  the SPA field 
in the initial request is set to 0.0.0.0. This way the ARP or neighbor 
caches of systems receiving this request are not updated. So, if there 
is a duplicate IP address, the receivers do not need to have their cache 
corrected.