Sent with broadcast destination MAC in Ethernet frame of ff:ff:ff:ff:ff:ff@ref
Sent without being solicited by a request, which therefore makes it ‘gratuitous’. But technically, it’s not exactly the same as a GratuitousARPRequest in which the ARP Sender IP and ARP Target IP are equal and not 0.0.0.0@ref
There is no complete mapping provided in the packet. The Sender IP is set to all zeros (unlike in an ARPAnnouncement), which means it cannot map to the Sender MAC address. The Target MAC address is all zeros, which means it cannot map to the Target IP address. This is intentional, because the reason for sending the ARP Probe is to prevent an IP conflict. If the target IP address is already in use, it would be very undesirable for other hosts on the network to inadvertently update their ARPCache based upon the contents of the ARP Probe. This is also the primary difference between an ARP Probe and a GratuitousARP. A Gratuitous ARP is meant to update all the ARP caches on the network, where as an ARP Probe deliberately prevents updating of ARP caches to continue protecting against IP address conflicts. @ref
BPF filter: arp and ether dst ff:ff:ff:ff:ff:ff and not (ether src ff:ff:ff:ff:ff:ff or ether src 00:00:00:00:00:00) and arp[6:2] = 1 and not ((arp[8:4] = 0xffffffff and arp[12:2] = 0xffff) or (arp[8:4] = 0 and arp[12:2] = 0)) and ether[6:4] = arp[8:4] and ether[10:2] = arp[12:2] and arp[18:4] = 0 and arp[22:2] = 0 and arp[14:4] = 0 and arp[24:4] != 0
MIKE HIGGINBOTTOM