Why ARP request is unicast?
I have a wireshark capture that indicating a unicast ARP request from source to destination.
As per my understanding ARP requests (including gratutious ARP) use broadcast. In what case the unicast ARP request is used ?
Solution 1:
See RFC1122, section 2.3.2.1 - ARP Cache Validation:
IMPLEMENTATION: Four mechanisms have been used, sometimes in
combination, to flush out-of-date cache entries.[...]
(2) Unicast Poll -- Actively poll the remote host by periodically sending a point-to-point ARP Request to it, and delete the entry if no ARP Reply is received from N successive polls. Again, the
timeout should be on the order of a minute, and typically N is 2.
Also, arping
is using unicast ARP requests to reduce the amount of broadcast traffic.