ARPAnnouncementWithTargetMAC

• Announcement naming a MAC in Target MAC, often the sender’s own
• Ethernet src matches Sender MAC. When it doesn’t, see ARPAnnouncementWithTargetMACSenderMACMismatch
• Rows:
  • ARPFieldComboRow451
• Profile:
  • Ethernet dst = ff:ff:ff:ff:ff:ff
  • Ethernet src = unicast
  • Ethernet type = 0x0806 (ARP)
  • ARP Opcode = 1
  • ARP Sender MAC = unicast
  • Ethernet src matches Sender MAC = yes
  • ARP Target MAC = unicast
  • ARP Sender IP vs Target IP = equal
  • Valid = yes
• BPF filter: arp and ether dst ff:ff:ff:ff:ff:ff and not (ether src ff:ff:ff:ff:ff:ff or ether src 00:00:00:00:00:00) and arp[6:2] = 1 and not ((arp[8:4] = 0xffffffff and arp[12:2] = 0xffff) or (arp[8:4] = 0 and arp[12:2] = 0)) and ether[6:4] = arp[8:4] and ether[10:2] = arp[12:2] and not ((arp[18:4] = 0xffffffff and arp[22:2] = 0xffff) or (arp[18:4] = 0 and arp[22:2] = 0)) and arp[14:4] = arp[24:4] and arp[14:4] != 0
• Wireshark display filter: arp && eth.dst == ff:ff:ff:ff:ff:ff && !(eth.src == ff:ff:ff:ff:ff:ff || eth.src == 00:00:00:00:00:00) && arp.opcode == 1 && !(arp.src.hw_mac == ff:ff:ff:ff:ff:ff || arp.src.hw_mac == 00:00:00:00:00:00) && eth.src == arp.src.hw_mac && !(arp.dst.hw_mac == ff:ff:ff:ff:ff:ff || arp.dst.hw_mac == 00:00:00:00:00:00) && arp.src.proto_ipv4 == arp.dst.proto_ipv4 && arp.src.proto_ipv4 != 0.0.0.0