Comments on: Gratuitous ARP

By: Al Silverstein

Al Silverstein — Tue, 19 Mar 2024 15:01:08 +0000

Nice job!

By: Ed Harmoush

Ed Harmoush — Mon, 15 Nov 2021 20:22:24 +0000

In reply to Jones. Yes. That sounds like an ARP issue. It seems the other devices on the network are still using the old ARP mapping. Windows Clients typically have very low ARP timeouts (30s or less), so changes in ARP mappings on the local network are detected much quicker.

By: Jones

Jones — Sun, 14 Nov 2021 11:36:10 +0000

Hi Ethan,
We have a interesting problem at our company and it can be related to GARP.

Scenario
Host A is connected to a switch but must be replaced with Host B. Host B must reuse IP from Host A. It’s not possible to use DHCP or another IP.
Often we see that Host B will not be correctly connected to the network – but clearing ARP-table in router solves the problem.

The affected hosts are pretty dumb hosts, like PLCs and similar. We never see this problem when using modern windows computer.

Can a possible solution be to enable GARP in Host B, to make sure Host B will broadcast it’s existence for router to update ARP with new mac-adress but the same IP?

(This is causing a lot of problem in our operations and as usual, the network is the problem..)

Best regards
Jones

By: Rafael

Rafael — Wed, 04 Aug 2021 04:52:37 +0000

I just read the rfc and there’s a note that says: What Stevens describes as ‘Gratuitous ARP’ is exactly the same package that this document refers to by the more descriptive term ‘ARP Announcement’. Gratuitous ARP “opcode1”

By: Ed Harmoush

Ed Harmoush — Tue, 03 Aug 2021 23:38:19 +0000

In reply to Rafael.

Gratuitous ARP and ARP Announcement serve the same purpose — update the ARP cache of neighbors with the ARP entry of the sendor. Gratuitous ARP can be Opcode 1 or 2. ARP Announcements must be opcode 1. Details here: https://datatracker.ietf.org/doc/html/rfc5227#section-3

The explicit different between ARP announcements and Gratuitous ARP is most likely splitting hairs, given they serve the same purpose.

The main one to keep separate from these is ARP Probe, which by design must not update the ARP cache of it’s neighbors.

By: Rafael

Rafael — Tue, 27 Jul 2021 14:52:27 +0000

I just read the comment in your article and from what I understand then a “Gratuitous ARP” (Opcode 1) is the same “ARP Announcement” – Opcode1 – but with different names. And “Gratuitous ARP” with – Opcode2 – also serves the same purpose as “Gratuitous ARP” – Opcode1 – and “ARP Announcement”. Unless the computer that just joined the network sends a “Gratuitous ARP” – Opcode1 – in order to receive the MAC from hosts that were already connected and the “Gratuitous ARP” – Opcode2 – in order to send its own MAC to the computers that were already connected. I didn’t really understand.

By: Mervyn Sirju

Mervyn Sirju — Mon, 28 Jun 2021 05:48:45 +0000

Gratuitous ARP is also a great ARP poisoning tool, highly recommended if you’re mischievous.

By: Ed Harmoush

Ed Harmoush — Thu, 10 Jun 2021 17:22:39 +0000

In reply to Krishna. Happy to help.

By: Ed Harmoush

Ed Harmoush — Thu, 10 Jun 2021 17:22:29 +0000

In reply to learner. You're welcome!

By: Krishna

Krishna — Wed, 09 Jun 2021 07:19:32 +0000

Thanks a lot, I wasted my time searching for this in Google.
You have explained everything in a detailed manner. And the diagrams are really great.