It's a response to a broadcast asking for the devices MAC ID. Routers and switches keep a table known as an ARP table which lists all the MAC ID's in the local area network. It will send ARP requests out to all the nodes in it's broadcast domain saying send me your MAC ID's. All the nodes in the network reply back with an ARP reply saying here is my MAC ID.
Gratuitous in this case means a request/reply that is not normally needed according to the ARP specification (RFC 826) but could be used in some cases. A gratuitous ARP request is an AddressResolutionProtocol request packet where the source and destination IP are both set to the IP of the machine issuing the packet and the destination MAC is the broadcast address ff:ff:ff:ff:ff:ff. Ordinarily, no reply packet will occur. A gratuitous ARP reply is a reply to which no request has been made.
Dynamic ARP table entries are created whne a client makes an ARP request that cannot be satisfied by data already in the ARP table.
ARP = Air Raid Precautions.
ARP is a Third layer or Network layer protocol. ARP is an address resolution protocol . The mechanism used by ARP to resolve IP address is look up table.
The purpose of an arp request is to map an IP address to a MAC address for the link layer to transmit a packet. For example, ARP will get a request to map 1.2.3.4 to a MAC address 12:fd:23:gf .Then ARP will cache the address mapping that next time an arp request doesnt need to happen
Gratuitous in this case means a request/reply that is not normally needed according to the ARP specification (RFC 826) but could be used in some cases. A gratuitous ARP request is an AddressResolutionProtocol request packet where the source and destination IP are both set to the IP of the machine issuing the packet and the destination MAC is the broadcast address ff:ff:ff:ff:ff:ff. Ordinarily, no reply packet will occur. A gratuitous ARP reply is a reply to which no request has been made.
Unicast
0X0800, 192.168.254.254
An ARP request is a broadcast Ethernet packet, that is, a packet sent onto the local physical network that all attached devices will receive. A device sends an ARP request to make the query "what is the MAC address (a.k.a. hardware address, link layer address, etc.) of this IP address (a.k.a Layer 3 address, logical network address, etc.)?" An ARP reply is an unicast Ethernet packet, sent from the device that currently owns the specified IP address, back to the device which sent the ARP request. That is, no other device will receive this packet. The ARP reply answers the requester's question, saying "IP address x.x.x.x is associated with MAC address xx:xx:xx:xx:xx:xx".
ARP is used to find a MAC (layer-2) address, if you know the IP (layer-3) address.First, a device will search its ARP cache, to see whether it already happens to have the required address. If it doesn't find the address, it will send an ARP request as a broadcast, which basically asks "Who has such-and-such an IP address?" The machine that has the requested IP address will send an ARP reply.
But if the gateway computer's knowledge of the destination computer's MAC address is either missing or too old and expired, it must send a broadcast to all of the computers on the LAN network asking which specific computer is assigned to the IP address of the packet the gateway is trying to forward. To do this the gateway broadcasts an ARP Request that will be received by every computer on the Ethernet LAN. The request simply asks for a reply from the one machine that is currently assigned to the IP contained in the request. Each computer on the LAN checks to see whether the IP is (one of) its own. The computer finding a match with (one of) its own IPs will send an ARP Reply back to the requesting device. When the gateway computer receives the ARP Reply, it has the MAC address of the replying computer along with the replying computer's IP address, contained in the reply packet. The receiving machine enters this information into a "cache" of all similar IP-address-to-MAC-address pairings which is maintained for every machine it has communicated with on the LAN. This is known as the machine's "ARP Cache" since it retains the history of all previous unexpired ARP Replies which it has received. Every computer participating on the LAN maintains its own similar ARP cache containing the IP-to-MAC relationships that allow them to properly address IP packets with Ethernet MAC addresses.Notice that in this example, our gateway computer added this new entry into its ARP cache upon the receipt of an ARP Reply packet. The ARP protocol is so simple - just asking who has the IP and replying "I have the IP" - that there is no provision for any sort of security or authentication of the replying computer. In other words, any computer on the LAN could claim to have the IP in question. The implementation of the ARP protocol is so simple and straightforward that the receipt of an ARP reply at any time, even when there are no ARP requests outstanding, causes the receiving computer to add the newly received information to its ARP cache. Consequently, if the gateway computer were to receive a SPOOFED ARP REPLY from an attacking computer claiming that it was assigned an IP that belonged to some other computer, the gateway would trustingly and blindly REPLACE its current correct entry with the maliciously misleading replacement! If at the same time the malicious attacking computer were to send a similar ARP reply to the computer being hijacked, maliciously replacing the ARP cache entry for the gateway computer, then any subsequent traffic bound for the gateway would instead be sent to the attacking computer. If the attacker forwards any of the redirected traffic it receives onto the proper original computer - after inspecting and perhaps even modifying the data - neither of the intercepted computers will detect that all of their communications is now being relayed through an unknown and probably malicious intermediary computer. By merely injecting two ARP reply packets into a totally trusting LAN, any malicious computer is able to receive all traffic going back and forth between any two computers on the LAN such as any target machine and the LAN's gateway.
The default time to keep the ARP table entry is 20 mins...For every 20mins the ARP table will be refreshed. Because, The neighboring device can be out of the network so the ARP table should be updated according to the network states. When the table gets refreshed the content will get erased and when the chance comes to resolve the MAC address to the known IP address the ARP request will be sent in broadcast mode where the reply will be in Unicast mode.
Dynamic ARP table entries are created whne a client makes an ARP request that cannot be satisfied by data already in the ARP table.
arp -a show arp
static arp
Arp Schnitger died in 1719.
The ISBN of Tech ARP is 0131455362.