0

For security reasons, I'd like to know for which of the following scenarios would a host (Debian for example) update its ARP table:

  1. It receives a gratuitous ARP for IPs that are not in its ARP table
  2. It receives a gratuitous ARP for IPs that are already in the ARP table (different MAC)
  3. It receives an ARP request that is not intended for it, but for other hosts on the network
  4. It receives an ARP request that is intended for it

Please note that in the four scenarios, the host did not initiate the ARP request.

UPDATE: In all of the four scenarios, the sender IP and mac are there in the arp packet. Therefore, the host could use such info to update its arp table. But my question is whether it would?

3
  • According to the RFC, only number 2 would result in changing the ARP table, but different OSes do things differently in the real world, and hosts/servers are off-topic here.
    – Ron Maupin
    Feb 5 at 13:26
  • @RonMaupin Thanks for your answer. But at which stackexchange such a question should be asked? Security?
    – AhmedWas
    Feb 5 at 14:46
  • You could try on Super User, but there is not necessarily an SE site for every question. In any case, look at the RFC. It has pseudocode for that.
    – Ron Maupin
    Feb 5 at 14:56

1 Answer 1

1

For examples 1 and 2, the host would update the ARP table.

Since in ARP requests the target is unknown, there is nothing to update. So nothing happens in examples 3 and 4.

You can read more in RFC 826.

3
  • But in (3) & (4), both the sender mac & IP are known. I mean they are there in the arp request packet. In Wireshark, they could be seen under: "Sender Mac Address" and "Sender IP address". Therefore, the host could use the sender information to update its arp table. So, the host could update, but my question is whether it would?
    – AhmedWas
    Feb 5 at 14:53
  • 1
    It's possible, I suppose, but I don't believe that's how it's implemented. Different OSes could operate differently. You could ask on Unix SE for specific details.
    – Ron Trunk
    Feb 5 at 15:10
  • Thanks! Up for both your comment & answer.
    – AhmedWas
    Feb 5 at 15:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.