ARP Request with Unicast MAC – Network Behavior Explained

arpwireshark

I would like to ask, with ARP request I got to believe that the destination MAC address was in all situations a broadcast address. Yet I got across a wireshark capture:
ARP wireshark capture

I just cannot understand the 3rd request from my router. Why is the destination MAC address of the request set to my NIC and not as broadcast? The last ARP request from the router is exactly how I would assume it to be (i.e. MAC is a broadcast).

( .1 is a router, .100 my PC, .103 second PC )

Best Answer

In an attempt to refresh an expired, or expiring, ARP entry, many Client OS's will issue a "targeted" ARP query to the MAC address they already expect. Most of the time, this prompts a response from the intended target and allows the entry to be refreshed without sending a broadcast to the entire network.

This will be the first time I've seen it with a Router, but it isn't too big of a stretch to think a Router vendor somewhere will have implemented ARP in the same way.

Nearly a Year Later Edit: I found a quote in RFC 1122 that describes this behavior:

2.3.2  Address Resolution Protocol -- ARP
   2.3.2.1  ARP Cache Validation
      An implementation of the Address Resolution Protocol (ARP)
      MUST provide a mechanism to flush out-of-date cache
      entries.  If this mechanism involves a timeout, it SHOULD be

      ...

      IMPLEMENTATION:
           Four mechanisms have been used, sometimes in
           combination, to flush out-of-date cache entries.

           ...

           (2)  Unicast Poll -- Actively poll the remote host by
                periodically sending a point-to-point ARP Request
                to it, and delete the entry if no ARP Reply is
                received from N successive polls.  Again, the
                timeout should be on the order of a minute, and
                typically N is 2.
Related Topic