7

I have a wireshark capture that indicating a unicast ARP request from source to destination.

Wireshark screenshot

As per my understanding ARP requests (including gratutious ARP) use broadcast. In what case the unicast ARP request is used ?

the-wabbit
  • 40,319
  • 13
  • 105
  • 169
Lunar Mushrooms
  • 173
  • 1
  • 1
  • 4

1 Answers1

11

See RFC1122, section 2.3.2.1 - ARP Cache Validation:

IMPLEMENTATION: Four mechanisms have been used, sometimes in
combination, to flush out-of-date cache entries.

[...]

(2) Unicast Poll -- Actively poll the remote host by periodically sending a point-to-point ARP Request to it, and delete the entry if no ARP Reply is received from N successive polls. Again, the
timeout should be on the order of a minute, and typically N is 2.

Also, arping is using unicast ARP requests to reduce the amount of broadcast traffic.

the-wabbit
  • 40,319
  • 13
  • 105
  • 169