Routelearn.net
Course menu

Unit 6: ARP and Local CommunicationLesson 6.3 (3 of 3 in this unit)33 of 84 in the Network Fundamentals course

ARP features

Gratuitous ARP, ARP probes and proxy ARP: what they're for and when they appear.

Intermediate · 6 min read

Gratuitous ARP, ARP probes and proxy ARP are uses of ARP beyond the normal request and reply. A gratuitous ARP announces a device's own IP-to-MAC mapping without being asked, an ARP probe checks whether an IPv4 address is already in use before a device claims it, and proxy ARP lets a router reply on behalf of a host in another network.

In simple terms: As well as asking “who has this IP address?”, ARP can announce “this IP address is mine”, check “is anyone already using this IP address?”, or let a router answer for a device behind it.

Gratuitous ARP: “this is me, everyone”

A gratuitous ARP is an ARP message that a host sends about its own address without anyone asking. The sender IP and the target IP are both the host's own address, and the message is sent as a broadcast. Devices that already have an ARP cache entry for that IP address update it, and switches learn which port the sender's MAC address is on.

Situation: two routers share a virtual gateway address (192.168.1.1) using HSRP (Hot Standby Router Protocol). The address uses a shared virtual MAC address. The active router fails, and the standby router takes over:

✕ link downR1was activeR2standby → activeSwitchPC APC B
  1. 1. R1 fails. The PCs' ARP caches still map 192.168.1.1 to the virtual MAC address, and the switch still sends that MAC address to R1's port.
  2. 2. R2 announces itself. The new active router sends a gratuitous ARP for 192.168.1.1 from the same virtual MAC address, so the switch immediately learns that this MAC address is now on R2's port.
  3. 3. Traffic follows. The PCs keep using 192.168.1.1 and the same MAC address, without noticing the change.

Hosts also send a gratuitous ARP when an interface comes up or its IP address changes.

ARP probe: “is anyone using this?”

Before using an address (for example, one just received from DHCP), many hosts send an ARP probe. This is an ARP request for that IP address with the sender IP set to 0.0.0.0, so no other device's cache is changed. If any device answers, the address is already in use, and the host reports a conflict (with DHCP, it declines the address). ARP probes are defined in RFC 5227.

Proxy ARP: a router answering for others

With proxy ARP, a router answers an ARP request for an IP address that isn't on the local subnet, giving its own MAC address. The host then sends the frame to the router, which routes the packet on to its destination.

Old PCno gateway setRouterproxy ARPServer10.0.0.5 (other subnet)
  1. 1. A host sends an ARP request for a remote IP. Usually this happens because it has no default gateway or a wrong subnet mask, so it thinks 10.0.0.5 is local.
  2. 2. The router answers on its behalf. It has a route to 10.0.0.5, so it replies with its own MAC address.
  3. 3. It works, silently. Traffic flows through the router, which hides the host's configuration mistake.

Proxy ARP is enabled by default on Cisco router interfaces. It can rescue unusual legacy setups, but it hides configuration mistakes and makes ARP caches large and confusing. Many networks disable it on each interface:

interface GigabitEthernet0/0 no ip proxy-arp

The no ip proxy-arp command turns proxy ARP off on that interface only. After that, hosts on the subnet must have a correct subnet mask and default gateway to reach other networks.

Check yourself

Predict · scenario 1

In a packet capture, you see an ARP broadcast where both the sender IP and the target IP are the host's own address. What type of message is it?

Predict · scenario 2

A PC with no default gateway configured can still reach other subnets. What is the most likely explanation?