A Digital Garden - frequent growth but a bit weedy in the back corner
StandardARPRequest
Broadcast request from Sender IP asking which Target MACAddress maps to the specified Target IPAddress
Lines 184-188 of RFC826 make it explicit that no constraints are placed on the contents of ar$tha, the Target MAC, in a StandardARPRequest. It is usually set to 00:00:00:00:00:00 but is often ff:ff:ff:ff:ff:ff
If a host is speaking to another host on the same IP network, the TargetProtocolAddress for the ARP request is the sought host’s IP address.
If a host is speaking to another host on a different IP network, the TargetProtocolAddress for the ARP request will be the Default Gateway’s IP address. @ref
If a router is delivering a packet to the destination host, the router’s ARP target will be the Host’s IP address.
If a router is delivering a packet to the next router in the path to the host, the ARP target will be the other Router’s Interface IP address – as indicated by the relative entry in the Routing table. @ref
BPF filter: arp and ether dst ff:ff:ff:ff:ff:ff and not (ether src ff:ff:ff:ff:ff:ff or ether src 00:00:00:00:00:00) and arp[6:2] = 1 and not ((arp[8:4] = 0xffffffff and arp[12:2] = 0xffff) or (arp[8:4] = 0 and arp[12:2] = 0)) and ether[6:4] = arp[8:4] and ether[10:2] = arp[12:2] and arp[18:4] = 0 and arp[22:2] = 0 and arp[14:4] != arp[24:4] and arp[14:4] != 0 and arp[24:4] != 0
MIKE HIGGINBOTTOM