ARP MAC is all Fs or all 0s.

[network_geek]

Hi All,

So I had captured an ARP packet and can see that Ethernet header has all FFs for an arp broadcast request while all 0s for Target MAC in the ARP header. Can someone shed light on this?

Regards.

[Seb Rupik · Accepted solution]

Hi there,

you are describing a standard ARP broadcast where a host is trying to determine the Layer2 address of another host. The destination MAC address in the Ethernet Frame is all F's to mark it as a broadcast frame so that the forwarding switch knows to forward it out of all switchports on the same VLAN expect for the one on which it was received. In the ARP packet there will be a destination IP but the sending host does not know the MAC address so all 0's are used as a place holder.

Hopefully the target host will receive this frame and send a unicast ARP reply back.

cheers,

Seb.