Gratuitous ARP is used when hosts need to update other local host ARP tables, check for duplicate IP address. When I google, I see sites telling that both Gratuitous ARP request and replies are being used.
As per the given below link Gratuitous ARP request Opcode: request (0x0001) is sent to check for duplicate IP address.
I tried the following two cases:
For both the case, I observed using Wireshark that Gratuitous ARP reply - Opcode: reply (0x0002) is sent by the router.
Ethernet II, Src: 02:02:02:02:02:02, Dst: ff:ff:ff:ff:ff:ff
Destination: ff:ff:ff:ff:ff:ff (Broadcast)
Source: 02:02:02:02:02:02 (02:02:02:02:02:02)
Type: ARP (0x0806)
Address Resolution Protocol (request/gratuitous ARP)
Hardware type: Ethernet (0x0001)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: request (0x0002)
Sender MAC address: 02:02:02:02:02:02 (02:02:02:02:02:02)
Sender IP address: 192.168.1.1 (192.168.1.1)
Target MAC address: ff:ff:ff:ff:ff:ff (Broadcast)
Target IP address: 192.168.1.1 (192.168.1.1)
Are Gratuitous ARP request Opcode: request (0x0001) being used or not? If yes, can someone please let me know when they are used?
Hello Kings -
We can add HSRP and GLBP as 2 more that do NOT do the opcode for a request either.
I spent a few minutes on GNS with wireshark, and could not get it to do it.
I followed the link you posted and read this:
"If one is trying to write software for moving IP addresses around that works with all routers, switches and IP stacks, it is best to send both the request and the reply. These are documented by RFC 2002 and RFC 826."
It seems Cisco only implemented the gratuitous Reply part of it.
Just wanted to give an update on my findings:
Windows Gratuitous ARP uses ARP Request while Cisco uses ARP Reply.
Windows sends a Gratuitous ARP with opcode 1 (ARP request). If there is any other device using the same IP, it sends ARP Reply (OPcode 2) with it's MAC address. Thus the Windows comes to know that the same IP address is being used.
It seems that the goal of Cisco and the goal of Windows is actually different. Windows is trying to determine if the IP address is in use with a request. Cisco is trying to update arp tables only. I agree with Keith said and that it seems prudent to send both. However, the arp table should be updated with simply a request alone. Additionally, the request will allow for duplicate IP detection. I guess Cisco devices assume that the administrator is responsible for proper IP addressing. In any case, thanks for posting your observations.
Google led me here when writing a blog post about Gratuitous ARPs.
I came into something weird / new recently called ARP Probe (RFC 5227) and have documented it down and hope will be useful for someone out there. Thanks.
Good observations about these concepts. Thanks.