GratuitousARPRequestBroadcastVsBlankTargetMAC

GratuitousARPRequest packets may have an ARP target MAC of ff:ff:ff:ff:ff:ff (GratuitousARPRequestBroadcastTarget) or 00:00:00:00:00:00 (GratuitousARPRequestBlankTarget).

There’s usually no substantive difference. The target MAC field in an ARP request is effectively a placeholder, because the sender is asking for that value and doesn’t know it yet. RFC826 has receivers ignore it, and RFC5227 only says it SHOULD be set to 00:00:00:00:00:00. A compliant receiver processes the packet the same way whichever value is there. @ref

The variation mostly reflects different network stacks or vendors. Most modern OSes use 00:00:00:00:00:00, while some other stacks, network devices and failover implementations fill in ff:ff:ff:ff:ff:ff. If you’re trying to work out which devices are sending which packets, the field can work as a rough fingerprint, but it doesn’t change what the packet means. @ref

Make sure you’re looking at the ARP payload’s target hardware address and not the Ethernet header’s destination MAC, since these are easy to mix up in a capture. For a gratuitous request or announcement, the Ethernet destination should be ff:ff:ff:ff:ff:ff so every host on the segment receives it. If that one is a unicast address, the packet only reaches one host and isn’t really announcing anything to the network. @ref

Very occasionally a picky device, security appliance or IDS rule treats one form differently. So if one sender’s announcements seem not to take effect on certain neighbours, it’s worth a look, but that’s an edge case. @ref