InvalidARPSenderMAC

• See also ARPCachePoisoning
• See also ARPSpoofing
• Invalid: Sender MAC ff:ff:ff:ff:ff:ff or 00:00:00:00:00:00 would put that address in receivers’ caches
• Rows here can also break:
  • ZeroIPsARPPacket
  • ZeroSenderIPARPReply
  • ZeroTargetIPARPRequest
  • UnusualARPOpCode
• Rows:
  • ARPFieldComboRow31-ARPFieldComboRow60
  • ARPFieldComboRow91-ARPFieldComboRow120
  • ARPFieldComboRow151-ARPFieldComboRow180
  • ARPFieldComboRow196-ARPFieldComboRow225
  • ARPFieldComboRow241-ARPFieldComboRow270
  • ARPFieldComboRow286-ARPFieldComboRow315
  • ARPFieldComboRow331-ARPFieldComboRow360
  • ARPFieldComboRow376-ARPFieldComboRow405
  • ARPFieldComboRow421-ARPFieldComboRow450
  • ARPFieldComboRow481-ARPFieldComboRow510
  • ARPFieldComboRow541-ARPFieldComboRow570
  • ARPFieldComboRow601-ARPFieldComboRow630
  • ARPFieldComboRow646-ARPFieldComboRow675
  • ARPFieldComboRow691-ARPFieldComboRow720
  • ARPFieldComboRow736-ARPFieldComboRow765
  • ARPFieldComboRow781-ARPFieldComboRow810
  • ARPFieldComboRow826-ARPFieldComboRow855
  • ARPFieldComboRow871-ARPFieldComboRow900
  • ARPFieldComboRow931-ARPFieldComboRow960
  • ARPFieldComboRow991-ARPFieldComboRow1020
  • ARPFieldComboRow1051-ARPFieldComboRow1080
  • ARPFieldComboRow1096-ARPFieldComboRow1125
  • ARPFieldComboRow1141-ARPFieldComboRow1170
  • ARPFieldComboRow1186-ARPFieldComboRow1215
  • ARPFieldComboRow1231-ARPFieldComboRow1260
  • ARPFieldComboRow1276-ARPFieldComboRow1305
  • ARPFieldComboRow1321-ARPFieldComboRow1350
• Profile:
  • Ethernet type = 0x0806 (ARP)
  • ARP Sender MAC = not unicast
  • Valid = no
• BPF filter: arp and ((arp[8:4] = 0xffffffff and arp[12:2] = 0xffff) or (arp[8:4] = 0 and arp[12:2] = 0))
• Wireshark display filter: arp && (arp.src.hw_mac == ff:ff:ff:ff:ff:ff || arp.src.hw_mac == 00:00:00:00:00:00)