Ip – Network Device sending ARP request (opcode 1) but with Source IP 0.0.0.0

arpip

Please help me to understand this behavior of one of my networking devices. It sends the ARP request broadcast with the source IP:0.0.0.0 .
I am only aware about 0.0.0.0 being used in "ARP Probes" where the Device should be sending :-

"who has MY-IP Please tell 0.0.0.0"

as the device wants to make sure no other device in the subnet has the same IP so to avoid IP conflict.

But in my case Device sends the ARP request broadcast(not an ARP probe because ARP probe should have asked for it's own IP) as

"who has DeviceX's-IP please tell 0.0.0.0" .

The device has an IP configured as 10.192.34.4, so in that case I would have expected it to send a request of the form :-

"who has DeviceX's-IP Please tell 10.192.34.4".

Consequently Device X should reply from which 10.192.34.4 will get its MAC address,the basic arp stuff but this "0.0.0.0" is out of my understanding.

Thank you

Best Answer

That is a standard ARP probe (RFC 5227) - a node requests an ARP resolution for the address it intends to use (and expects no reply).

ARP works on top of layer 2 (Ethernet) and does not use a standard IP packet. Accordingly, any node answering to an ARP request doesn't reply to the Sender Protocol Address (SPA) but to the Sender Hardware Address (SHA).

An ARP probe uses the all-zero sender's address 0.0.0.0 to avoid trashing the other nodes' ARP caches.

Related Topic