ARP destination: 00:00:00_00:00 (00:00:00:00:00:00)

[thanikachalamm]

Hi,

I have done packet capture on one of the server port through Wireshark and I am confused by looking at the ART broadcast packet. I can understand that the Target hardware address is 00:00:00_00:00 (00:00:00:00:00:00) since the originating station does not know the MAC address of the destination workstation but I don’t understand how come the broadcast packet shows destination address shows as 00:00:00_00:00 (00:00:00:00:00:00) instead of ff:ff:ff:ff:ff:ff. can any one explain me the reason and correct me if I am wrong?

Please refer the screenshot attached.

[jimmysands73_2 · Accepted solution]

Looks like it has to do with gratitious arp

http://wiki.wireshark.org/Gratuitous_ARP

-Does the target MAC address ever matter in requests? I gather Solaris uses ff:ff:ff:ff:ff:ff in its standard ARP requests and most other OSes use 00:00:00:00:00:00 instead. Is the use of the ff:ff:ff:ff:ff:ff MAC in the target address above significant in any way? Obviously having a destination address of ff:ff:ff:ff:ff:ff is critical.yes

RFC 3927, which is based on Gratuitous ARP, specifies 00:00:00:00:00:00 for the target MAC. However many simple TCP/IP stacks have an API which permits the specification of only one MAC value, and when the Ethernet Destination field is set to 'broadcast', the ARP target is also set 'broadcast'. Note: Normal ARP requests have the same value in the ARP Packet Target MAC address as in the Ethernet Destination field.

[thanikachalamm]

Jimmy,

Thank you very much for the clarification. My only confusion was how come the destination MAC field can be 00:00:00_00:00:00 for a broadcast packet.

Thanks once again for the reply.

Regards,

Thanikachalam.