GratuitousARPRequest

• Also referred to as ‘Unsolicited ARP request frames’, which are broadcast ARP requests initiated by a host owning an IP address @ref
• GratuitousARPRequestVsReply
• BroadcastTraffic on a network when a host changes its IP so other hosts can update their ARPCache
• Used for ARPDuplicateAddressDetection
• Also sent by some OperatingSystems on startup and to help with LoadBalancing
• GratuitousARPRequestBroadcastTarget
• GratuitousARPRequestBlankTarget
• GratuitousARPRequestBroadcastVsBlankTargetMAC
• Ethernet src not matching Sender MAC: another card sent the frame on the ARP sender’s behalf, as with a bridged or virtualised host, ProxyARP or MACAddressSpoofing
• Looks like an StandardARPRequest packet but the sender and target IPs are the same
• Sender MAC and Sender IP create a complete mapping so it will trigger ARPCache updates @ref