ARPProbeConflictFoundResponse

• Means: someone already owns the probed IP and is letting the ARPProbe host know that a conflict is present
• Eth dst unicast, Target MAC unicast: Conflict defence: answers a probe, telling the prober Sender IP is taken
• Eth dst unicast, Target MAC ff:ff:ff:ff:ff:ff: Conflict defence with Target MAC ff:ff:ff:ff:ff:ff; malformed
• Eth dst unicast, Target MAC 00:00:00:00:00:00: Conflict defence with no Target MAC; malformed, the prober’s MAC belongs there
• Eth dst ff:ff:ff:ff:ff:ff, Target MAC unicast: Broadcast conflict defence; RFC 5227 allows broadcast replies
• Eth dst ff:ff:ff:ff:ff:ff, Target MAC ff:ff:ff:ff:ff:ff: Broadcast defence of Sender IP aimed at no prober; unusual
• Eth dst ff:ff:ff:ff:ff:ff, Target MAC 00:00:00:00:00:00: Broadcast defence of Sender IP aimed at no prober; unusual
• Ethernet src matches Sender MAC. When it doesn’t, see ARPProbeConflictFoundResponseSenderMACMismatch
• Rows:
  • ARPFieldComboRow67
  • ARPFieldComboRow77
  • ARPFieldComboRow87
  • ARPFieldComboRow517
  • ARPFieldComboRow527
  • ARPFieldComboRow537
• Profile:
  • Ethernet dst = not 00:00:00:00:00:00
  • Ethernet src = unicast
  • Ethernet type = 0x0806 (ARP)
  • ARP Opcode = 2
  • ARP Sender MAC = unicast
  • Ethernet src matches Sender MAC = yes
  • ARP Sender IP vs Target IP = target 0.0.0.0
  • Valid = yes
• BPF filter: arp and not (ether dst 00:00:00:00:00:00) and not (ether src ff:ff:ff:ff:ff:ff or ether src 00:00:00:00:00:00) and arp[6:2] = 2 and not ((arp[8:4] = 0xffffffff and arp[12:2] = 0xffff) or (arp[8:4] = 0 and arp[12:2] = 0)) and ether[6:4] = arp[8:4] and ether[10:2] = arp[12:2] and arp[14:4] != 0 and arp[24:4] = 0
• Wireshark display filter: arp && !(eth.dst == 00:00:00:00:00:00) && !(eth.src == ff:ff:ff:ff:ff:ff || eth.src == 00:00:00:00:00:00) && arp.opcode == 2 && !(arp.src.hw_mac == ff:ff:ff:ff:ff:ff || arp.src.hw_mac == 00:00:00:00:00:00) && eth.src == arp.src.hw_mac && arp.src.proto_ipv4 != 0.0.0.0 && arp.dst.proto_ipv4 == 0.0.0.0