StandardARPResponseBroadcastTargetMAC

• Reply with Target MAC ff:ff:ff:ff:ff:ff; malformed
• Ethernet src matches Sender MAC. When it doesn’t, see StandardARPResponseBroadcastTargetMACSenderMACMismatch
• Rows:
  • ARPFieldComboRow73
• Profile:
  • Ethernet dst = unicast
  • Ethernet src = unicast
  • Ethernet type = 0x0806 (ARP)
  • ARP Opcode = 2
  • ARP Sender MAC = unicast
  • Ethernet src matches Sender MAC = yes
  • ARP Target MAC = ff:ff:ff:ff:ff:ff
  • ARP Sender IP vs Target IP = different
  • Valid = yes
• BPF filter: arp and not (ether dst ff:ff:ff:ff:ff:ff or ether dst 00:00:00:00:00:00) and not (ether src ff:ff:ff:ff:ff:ff or ether src 00:00:00:00:00:00) and arp[6:2] = 2 and not ((arp[8:4] = 0xffffffff and arp[12:2] = 0xffff) or (arp[8:4] = 0 and arp[12:2] = 0)) and ether[6:4] = arp[8:4] and ether[10:2] = arp[12:2] and arp[18:4] = 0xffffffff and arp[22:2] = 0xffff and arp[14:4] != arp[24:4] and arp[14:4] != 0 and arp[24:4] != 0
• Wireshark display filter: arp && !(eth.dst == ff:ff:ff:ff:ff:ff || eth.dst == 00:00:00:00:00:00) && !(eth.src == ff:ff:ff:ff:ff:ff || eth.src == 00:00:00:00:00:00) && arp.opcode == 2 && !(arp.src.hw_mac == ff:ff:ff:ff:ff:ff || arp.src.hw_mac == 00:00:00:00:00:00) && eth.src == arp.src.hw_mac && arp.dst.hw_mac == ff:ff:ff:ff:ff:ff && arp.src.proto_ipv4 != arp.dst.proto_ipv4 && arp.src.proto_ipv4 != 0.0.0.0 && arp.dst.proto_ipv4 != 0.0.0.0