6 Replies Latest reply: Aug 5, 2011 10:22 AM by Elvin Arias RSS

    Gratuitous ARP

    Kingsley - CCSP/CCIP/ CCNP/CCIE Security

      Hi all


      Gratuitous ARP is used when hosts need to update other local host ARP tables, check for duplicate IP address. When I google, I see sites telling that both Gratuitous ARP request and replies are being used.


      As per the given below link Gratuitous ARP request Opcode: request (0x0001) is sent to check for duplicate IP address.






      I tried the following two cases:


      • shut down/ no shut an interface
      • Configured an IP address for an interface


      For both the case, I observed using Wireshark that Gratuitous ARP reply - Opcode: reply (0x0002) is sent by the router.



      Ethernet II, Src: 02:02:02:02:02:02, Dst: ff:ff:ff:ff:ff:ff
          Destination: ff:ff:ff:ff:ff:ff (Broadcast)
          Source: 02:02:02:02:02:02 (02:02:02:02:02:02)
          Type: ARP (0x0806)
          Trailer: 000000000000000000000000000000000000
      Address Resolution Protocol (request/gratuitous ARP)
          Hardware type: Ethernet (0x0001)
          Protocol type: IP (0x0800)
          Hardware size: 6
          Protocol size: 4
          Opcode: request (0x0002)
          Sender MAC address: 02:02:02:02:02:02 (02:02:02:02:02:02)

          Sender IP address: (
          Target MAC address: ff:ff:ff:ff:ff:ff (Broadcast)

          Target IP address: (




      Are Gratuitous ARP request Opcode: request (0x0001) being used or not? If yes, can someone please let me know when they are used?




      With regards