Does gratuitous ARP work like a normal ARP request?
Why is gratuitous ARP used for HSRP?
-
3Did you read up on this somewhere? If you didn't, you should. If you did and something isn't clear, please be more specific in your question.– GerbenCommented May 2, 2014 at 7:07
-
@Gerben i'm clear about how arp works, but this concept is my confusing part especially in HSRP how this ARP works..– TrojanCommented May 2, 2014 at 7:46
-
1One says Grauitous ARP is a request while the other shows a Wireshark scheme saying it's a Reply. Is it some sort of random behaviour? In my computer a sniffed Gratuitous ARP packet was also noted as a Request (Opcode: 1).– VITOR FERNANDES DE BARROSCommented Mar 28, 2019 at 17:30
Add a comment
|
3 Answers
Gratuitous ARP is a sort of "advance notification", it updates the ARP cache of other systems before they ask for it (no ARP request) or to update outdated information.
When talking about gratuitous ARP, the packets are actually special ARP request packets, not ARP reply packets as one would perhaps expect. Some reasons for this are explained in RFC 5227.
The gratuitous ARP packet has the following characteristics:
- Both source and destination IP in the packet are the IP of the host issuing the gratuitous ARP
- The destination MAC address is the broadcast MAC address (
ff:ff:ff:ff:ff:ff)- This means the packet will be flooded to all ports on a switch
- No reply is expected
Gratuitous ARP is used for some reasons:
- Update ARP tables after a MAC address for an IP changes (failover, new NIC, etc.)
- Update MAC address tables on L2 devices (switches) that a MAC address is now on a different port
- Send gratuitous ARP when interface goes up to notify other hosts about new MAC/IP bindings in advance so that they don't have to use ARP requests to find out
- When a reply to a gratuitous ARP request is received you know that you have an IP address conflict in your network
As for the second part of your question, HSRP, VRRP etc. use gratuitous ARP to update the MAC address tables on L2 devices (switches). Also there is the option to use the burned-in MAC address for HSRP instead of the "virtual"one. In that case the gratuitous ARP would also update the ARP tables on L3 devices/hosts.
answered May 2, 2014 at 8:17
-
-
-
-
1You can see an example packet on the Wireshark Homepage Commented May 4, 2014 at 18:27
-
1Because you're receiving an answer for an ARP request which has your own IP in it. So someone else has this IP and is answering accordingly. Commented Aug 12, 2014 at 12:07
A Gratuitous ARP is an ARP Response that was not prompted by an ARP Request. The Gratuitous ARP is sent as a broadcast frame, as a way for a node to announce or update its IP to MAC mapping to the entire network.
An ARP Packet contains an "Opcode" field which indicates whether the packet is a request or a response. In the Gratuitous ARP, the Opcode field is set to 2, which indicate a Response:
There are many use cases for Gratuitous ARP, all typically having to do with some sort of need to update the ARP Mapping or Switchport MAC address tables.
HSRP (and many other redundancy protocols) use Gratuitous ARP frequently. This animation will illustrate how:
Notice RouterA and RouterB are sharing the IP Address 10.0.0.1 and the MAC address 0053.ffff.1111. The Host's are configure with a default gateway of 10.0.0.1, and they each have an ARP mapping indicating the 10.0.0.1 IP address maps to the 0053.ffff.1111 MAC address. Since both the MAC address and IP address are shared between the two routers, this ARP Mapping will never have to be updated.
However, when RouterA is the active HSRP router, the MAC address is being served by the device connected to switchport 1. If RouterA fails, then RouterB sends a Gratuitous ARP to update the switch's MAC address table that the MAC address 0053.ffff.1111 is now being served by the device connected to switchport 2.
The process occurs again if RouterB fails, and RouterA needs to take back over serving the IP/MAC 10.0.0.1/0053.ffff.1111
The Packet Capture of the HSRP transitions and GARP packets in the animation above can be downloaded and studied in Wireshark.
While not strictly something you asked about, given the comments in this Q&A I thought it wise to mention something about duplicate address detection:
There is an often confused point regarding duplicate address detection and Gratuitous ARP. When a computer is trying to see if another host on the network is using a particular IP address it does not send a Gratuitous ARP.
The reason for this is by definition, a Gratuitous ARP is meant to update the ARP mappings of other devices on the network. If an IP is not unique, we wouldn't want the "test for uniqueness" to cause an incorrect ARP entry to be updated.
In reality, a specific set of ARP Messages are used in duplicate address detection: an ARP Probe and ARP Announcement.
The crucial difference between these two packets and an actual Gratuitous ARP, is the ARP Probe does not have a complete IP/MAC mapping, therefore it is impossible for an ARP Probe to accidentally erroneously update an ARP Cache.
The general process is the ARP Probe is sent a few times, which would prompt the owner of the IP in question to send a Gratuitous ARP if the IP is already in use. If no response is received, then the sender sends an ARP Announcement to officially claim the IP address on the network.
The ARP Announcement is even more similar to a Gratuitous ARP, but it (also) is not technically the same because the ARP Announcement has an opcode of 1, indicating a request (where as a Gratuitous ARP will have an opcode of 2).
If you want some video there is a Great explanation here.
