UnicastGratuitousARPReplySenderMACMismatch

• UnicastGratuitousARPReply with an Ethernet src that doesn’t match Sender MAC
• Another card sent the frame on the ARP sender’s behalf, as with a bridged or virtualised host, ProxyARP or MACAddressSpoofing
• Rows:
  • ARPFieldComboRow62
  • ARPFieldComboRow72
  • ARPFieldComboRow82
• Profile:
  • Ethernet dst = unicast
  • Ethernet src = unicast
  • Ethernet type = 0x0806 (ARP)
  • ARP Opcode = 2
  • ARP Sender MAC = unicast
  • Ethernet src matches Sender MAC = no
  • ARP Sender IP vs Target IP = equal
  • Valid = yes
• BPF filter: arp and not (ether dst ff:ff:ff:ff:ff:ff or ether dst 00:00:00:00:00:00) and not (ether src ff:ff:ff:ff:ff:ff or ether src 00:00:00:00:00:00) and arp[6:2] = 2 and not ((arp[8:4] = 0xffffffff and arp[12:2] = 0xffff) or (arp[8:4] = 0 and arp[12:2] = 0)) and not (ether[6:4] = arp[8:4] and ether[10:2] = arp[12:2]) and arp[14:4] = arp[24:4] and arp[14:4] != 0
• Wireshark display filter: arp && !(eth.dst == ff:ff:ff:ff:ff:ff || eth.dst == 00:00:00:00:00:00) && !(eth.src == ff:ff:ff:ff:ff:ff || eth.src == 00:00:00:00:00:00) && arp.opcode == 2 && !(arp.src.hw_mac == ff:ff:ff:ff:ff:ff || arp.src.hw_mac == 00:00:00:00:00:00) && eth.src != arp.src.hw_mac && arp.src.proto_ipv4 == arp.dst.proto_ipv4 && arp.src.proto_ipv4 != 0.0.0.0