9

I have a Wireshark capture that indicates a unicast ARP request from source to destination.

Wireshark screenshot

As per my understanding, ARP requests (including gratuitous ARP) use broadcast.

In what cases are unicast ARP requests used?

1 Answers1

13

See RFC1122, section 2.3.2.1 - ARP Cache Validation:

IMPLEMENTATION: Four mechanisms have been used, sometimes in combination, to flush out-of-date cache entries.

[...]

(2) Unicast Poll -- Actively poll the remote host by periodically sending a point-to-point ARP Request to it, and delete the entry if no ARP Reply is received from N successive polls. Again, the timeout should be on the order of a minute, and typically N is 2.

Also, arping uses unicast ARP requests to reduce the amount of broadcast traffic.

the-wabbit
  • 41,352