UnusualARPOpCode

• Invalid: Opcode is neither 1 nor 2, so it’s neither an ARP request nor a reply
• Means: legacy or WAN protocols, such as RARP (3, 4) or InverseARP (8, 9), or a malformed packet. Seeing these on a home LAN would be odd.
• Rows:
  • ARPFieldComboRow121-ARPFieldComboRow180
  • ARPFieldComboRow271-ARPFieldComboRow315
  • ARPFieldComboRow406-ARPFieldComboRow450
  • ARPFieldComboRow571-ARPFieldComboRow630
  • ARPFieldComboRow721-ARPFieldComboRow765
  • ARPFieldComboRow856-ARPFieldComboRow900
  • ARPFieldComboRow1021-ARPFieldComboRow1080
  • ARPFieldComboRow1171-ARPFieldComboRow1215
  • ARPFieldComboRow1306-ARPFieldComboRow1350
• Profile:
  • Ethernet type = 0x0806 (ARP)
  • ARP Opcode = other
  • Valid = no
• BPF filter: arp and arp[6:2] != 1 and arp[6:2] != 2
• Wireshark display filter: arp && arp.opcode != 1 && arp.opcode != 2