garp in sniff traffic

[suthomas1]

Hello all,

I am seeing this gratuitous arp in wireshark traces.
is it normal in a network.
Appreciate if someone could explain a bit about this occurence.

Lantroni_ac:5e:fc Broadcast ARP Gratuitous ARP for 192.168.100.11 (Request)

the ip 192.168.100.11 belongs to a host.
I have just included a brief liner from the capture here.

Thanks in advance.

[cofee]

Gratuitous arp occurs when a host sends an ARP request looking for its own address. This is usually done when the interface is configured "up" at bootstrap time. In this packet, sender's and target protocol address are identical 192.168.100.11.

This kind of arp achieves two goals:

a) It lets a host determine if another host is already configured with the same ip address. Because the host sending this arp request is not expecting a reply back and if a reply is received, the error message "duplicate IP address sent from Ethernet address" is usually displayed.

b) If the host sending the grat arp has changed its hardware address, this frame causes any other host receiving the broadcast that has an entry in its cache for the old hardware address to update its rap cache entry.

[suthomas1]

Thanks, so is there is a possibility that this garp can be initiated by layer 3 routers resulting in ip conflicts for users by any means?

[cofee]

Yes, layer 3 device will detect that there is another device on the network that's configured with the same ip address.