Interesting Traces - Unicast ARP Requests

Blue Bar separator


I ran across this trace while looking for something else. It took a few minutes for this to sink in. Basically 172.16.1.2 is sending an ARP request looking for 172.16.1.9. The unusual thing is that instead of sending the request to the Ethernet broadcast address it is sending it to the MAC address of 172.16.1.9. Why send an ARP looking for the MAC address of a host when you already know the MAC address of the host? In addition it seems to be doing it about every 35 seconds which seems awful fast. 
No.     Time        Source         Destination    Protocol Info
  40923 0.000000    172.16.1.2     172.16.1.9     ARP      Who has 172.16.1.9?  Tell 172.16.1.2
  40924 0.003424    172.16.1.9     172.16.1.2     ARP      172.16.1.9 is at 00:00:a8:84:81:73
  40930 34.992054   172.16.1.2     172.16.1.9     ARP      Who has 172.16.1.9?  Tell 172.16.1.2
  40931 0.003669    172.16.1.9     172.16.1.2     ARP      172.16.1.9 is at 00:00:a8:84:81:73
  40938 34.998005   172.16.1.2     172.16.1.9     ARP      Who has 172.16.1.9?  Tell 172.16.1.2
  40939 0.002114    172.16.1.9     172.16.1.2     ARP      172.16.1.9 is at 00:00:a8:84:81:73
  40945 35.020342   172.16.1.2     172.16.1.9     ARP      Who has 172.16.1.9?  Tell 172.16.1.2
  40946 0.002499    172.16.1.9     172.16.1.2     ARP      172.16.1.9 is at 00:00:a8:84:81:73
  40950 34.999767   172.16.1.2     172.16.1.9     ARP      Who has 172.16.1.9?  Tell 172.16.1.2
  40951 0.002537    172.16.1.9     172.16.1.2     ARP      172.16.1.9 is at 00:00:a8:84:81:73
  40957 44.005291   172.16.1.2     172.16.1.9     ARP      Who has 172.16.1.9?  Tell 172.16.1.2
  40958 0.002161    172.16.1.9     172.16.1.2     ARP      172.16.1.9 is at 00:00:a8:84:81:73
  40962 34.993470   172.16.1.2     172.16.1.9     ARP      Who has 172.16.1.9?  Tell 172.16.1.2
  40963 0.002253    172.16.1.9     172.16.1.2     ARP      172.16.1.9 is at 00:00:a8:84:81:73
  40968 38.005976   172.16.1.2     172.16.1.9     ARP      Who has 172.16.1.9?  Tell 172.16.1.2
  40969 0.002307    172.16.1.9     172.16.1.2     ARP      172.16.1.9 is at 00:00:a8:84:81:73

  
  No.     Time        Source       Destination    Protocol Info
  40923 0.000000    172.16.1.2     172.16.1.9     ARP      Who has 172.16.1.9?  Tell 172.16.1.2

Frame 40923 (64 bytes on wire, 64 bytes captured)
    Arrival Time: Aug  2, 2006 06:03:23.366754000
    Time delta from previous packet: 68.951143000 seconds
    Time since reference or first frame: 46686.741000000 seconds
    Frame Number: 40923
    Packet Length: 64 bytes
    Capture Length: 64 bytes
Ethernet II, Src: 00:0e:d6:aa:bb:3c, Dst: 00:00:a8:cc:dd:73
    Destination: 00:00:a8:cc:dd:73 (172.16.1.9)
    Source: 00:0e:d6:aa:bb:3c (172.16.1.2)
    Type: ARP (0x0806)
    Trailer: 00000000000000000000000000000000...
    Frame check sequence: 0x1230f4a4 (correct)
Address Resolution Protocol (request)
    Hardware type: Ethernet (0x0001)
    Protocol type: IP (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: request (0x0001)
    Sender MAC address: 00:0e:d6:aa:bb:3c (172.16.1.2)
    Sender IP address: 172.16.1.2 (172.16.1.2)
    Target MAC address: 00:00:a8:cc:dd:73 (172.16.1.9)
    Target IP address: 172.16.1.9 (172.16.1.9)

All I know is that the 172.16.1.2 is Cisco 6506 running IOS 12.2(17a)SX2.

Blue Bar separator
This page was last modified on 06-08-09
mailbox Send comments and suggestions
to ndav1@cox.net