UnicastCacheCheckARPRequestsBlankTargetMACSenderMACMismatch

• Looks like: StandardARPRequest but with a specific MAC in Ethernet dst - expects confirmation from the specific target host.
• Means: the sender is checking that an entry it already has is still correct. Linux does this routinely, and some network monitors poll this way.
• UnicastCacheCheckARPRequestsBlankTargetMAC with an Ethernet src that doesn’t match Sender MAC
• Another card sent the frame on the ARP sender’s behalf, as with a bridged or virtualised host, ProxyARP or MACAddressSpoofing
• Usually the sender leaves target MACs as 00:00:00:00:00:00
• Both UnicastCacheCheckARPRequestsUnicastTargetMAC and UnicastCacheCheckARPRequestsBlankTargetMAC are normal. Neither ARP standard requires a value there, and a device answering a request ignores the field.
• Rows:
  • ARPFieldComboRow24
• Profile:
  • Ethernet dst = unicast
  • Ethernet src = unicast
  • Ethernet type = 0x0806 (ARP)
  • ARP Opcode = 1
  • ARP Sender MAC = unicast
  • Ethernet src matches Sender MAC = no
  • ARP Target MAC = 00:00:00:00:00:00
  • ARP Sender IP vs Target IP = different
  • Valid = yes
• BPF filter: arp and not (ether dst ff:ff:ff:ff:ff:ff or ether dst 00:00:00:00:00:00) and not (ether src ff:ff:ff:ff:ff:ff or ether src 00:00:00:00:00:00) and arp[6:2] = 1 and not ((arp[8:4] = 0xffffffff and arp[12:2] = 0xffff) or (arp[8:4] = 0 and arp[12:2] = 0)) and not (ether[6:4] = arp[8:4] and ether[10:2] = arp[12:2]) and arp[18:4] = 0 and arp[22:2] = 0 and arp[14:4] != arp[24:4] and arp[14:4] != 0 and arp[24:4] != 0
• Wireshark display filter: arp && !(eth.dst == ff:ff:ff:ff:ff:ff || eth.dst == 00:00:00:00:00:00) && !(eth.src == ff:ff:ff:ff:ff:ff || eth.src == 00:00:00:00:00:00) && arp.opcode == 1 && !(arp.src.hw_mac == ff:ff:ff:ff:ff:ff || arp.src.hw_mac == 00:00:00:00:00:00) && eth.src != arp.src.hw_mac && arp.dst.hw_mac == 00:00:00:00:00:00 && arp.src.proto_ipv4 != arp.dst.proto_ipv4 && arp.src.proto_ipv4 != 0.0.0.0 && arp.dst.proto_ipv4 != 0.0.0.0