This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

ARP request from DHCP server NOT broadcasted (ARP unicast)

0

Hi everyone,

I am capturing traces of my home network and I am seeing ARP requests from the router connected to the Internet to my PC every 20-30 seconds. As this router is configured to serve IP addresses (DHCP) I suppose this is normal traffic.

What is buffling me is that the router is not broadcasting the ARP requests, but sending them to the MAC address of my PC. I have checked the source MAC address and IP address of the ARP request and they are really corresponds to the ones of the router router (does not seem to be any spoofing going on).

Here an instance of such a request:

5 143.028579000 00:24:fe:c1:xx:xx 50:46:5d:70:xx:xx ARP 60 Who has 192.168.2.114? Tell 192.168.2.1

Does anyone have any idea when an ARP request is allowed not to be broadcasted, but sent with a destination address?

Thanks

asked 04 Jun '14, 02:15

mabad's gravatar image

mabad
16115
accept rate: 0%

edited 05 Jun '14, 04:18

I have also noticed that my PC is also sending ARP requests, but more scarcely, to the DCHP Server (a router) containing the MAC Address of the router within the Ethernet frame, like the requests from the router is doing. The router and the PC send in the ARP request 0:0:0:0:0:0 as the Destination MAC Address (which theoretically they are asking for, but curiously they might seem to know about it as they are sending the frame to the MAC Address of the device in question).

(04 Jun '14, 08:14) mabad

One Answer:

3

This is normal if they're just attempting to refresh their ARP cache. You should still see the "Target MAC" as all zeros but if the MAC was known already it would just be costly network-wise to broadcast for a refresh.

answered 04 Jun '14, 20:16

Quadratic's gravatar image

Quadratic
1.9k6928
accept rate: 13%

Thanks. All I had read about ARP is that requests are always broadcasted. Just wanted to confirm that there are exceptions that confirm the rule.

(05 Jun '14, 01:50) mabad

If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.

(05 Jun '14, 02:02) grahamb ♦

I have checked the RFC 1122. The implementation part of the ARP protocol is stated: (2) Unicast Poll -- Actively poll the remote host by periodically sending a point-to-point ARP Request to it, and delete the entry if no ARP Reply is received from N successive polls.

(05 Jun '14, 04:15) mabad