6 Replies Latest reply: Aug 5, 2011 10:22 AM by Elvin Arias RSS

    Gratuitous ARP

    Kingsley - CCSP/CCIP/ CCNP/CCIE Security

      Hi all

       

      Gratuitous ARP is used when hosts need to update other local host ARP tables, check for duplicate IP address. When I google, I see sites telling that both Gratuitous ARP request and replies are being used.

       

      As per the given below link Gratuitous ARP request Opcode: request (0x0001) is sent to check for duplicate IP address.

       

       

      http://cauew.blogspot.com/2008/08/arp-rarp-proxy-arp-gratuitous-arp-and.html

       

       

      I tried the following two cases:

       

      • shut down/ no shut an interface
      • Configured an IP address for an interface

       

      For both the case, I observed using Wireshark that Gratuitous ARP reply - Opcode: reply (0x0002) is sent by the router.

       

       

      Ethernet II, Src: 02:02:02:02:02:02, Dst: ff:ff:ff:ff:ff:ff
          Destination: ff:ff:ff:ff:ff:ff (Broadcast)
          Source: 02:02:02:02:02:02 (02:02:02:02:02:02)
          Type: ARP (0x0806)
          Trailer: 000000000000000000000000000000000000
      Address Resolution Protocol (request/gratuitous ARP)
          Hardware type: Ethernet (0x0001)
          Protocol type: IP (0x0800)
          Hardware size: 6
          Protocol size: 4
          Opcode: request (0x0002)
          Sender MAC address: 02:02:02:02:02:02 (02:02:02:02:02:02)

          Sender IP address: 192.168.1.1 (192.168.1.1)
          Target MAC address: ff:ff:ff:ff:ff:ff (Broadcast)

          Target IP address: 192.168.1.1 (192.168.1.1)

       

       

       

      Are Gratuitous ARP request Opcode: request (0x0001) being used or not? If yes, can someone please let me know when they are used?

       

       

       

      With regards

      Kings