Interesting Traces - Unicast ARP Requests

Blue Bar separator

I ran across this trace while looking for something else. It took a few minutes for this to sink in. Basically is sending an ARP request looking for The unusual thing is that instead of sending the request to the Ethernet broadcast address it is sending it to the MAC address of Why send an ARP looking for the MAC address of a host when you already know the MAC address of the host? In addition it seems to be doing it about every 35 seconds which seems awful fast.
No.     Time        Source         Destination    Protocol Info
  40923 0.000000     ARP      Who has  Tell
  40924 0.003424     ARP is at 00:00:a8:84:81:73
  40930 34.992054     ARP      Who has  Tell
  40931 0.003669     ARP is at 00:00:a8:84:81:73
  40938 34.998005     ARP      Who has  Tell
  40939 0.002114     ARP is at 00:00:a8:84:81:73
  40945 35.020342     ARP      Who has  Tell
  40946 0.002499     ARP is at 00:00:a8:84:81:73
  40950 34.999767     ARP      Who has  Tell
  40951 0.002537     ARP is at 00:00:a8:84:81:73
  40957 44.005291     ARP      Who has  Tell
  40958 0.002161     ARP is at 00:00:a8:84:81:73
  40962 34.993470     ARP      Who has  Tell
  40963 0.002253     ARP is at 00:00:a8:84:81:73
  40968 38.005976     ARP      Who has  Tell
  40969 0.002307     ARP is at 00:00:a8:84:81:73

  No.     Time        Source       Destination    Protocol Info
  40923 0.000000     ARP      Who has  Tell

Frame 40923 (64 bytes on wire, 64 bytes captured)
    Arrival Time: Aug  2, 2006 06:03:23.366754000
    Time delta from previous packet: 68.951143000 seconds
    Time since reference or first frame: 46686.741000000 seconds
    Frame Number: 40923
    Packet Length: 64 bytes
    Capture Length: 64 bytes
Ethernet II, Src: 00:0e:d6:aa:bb:3c, Dst: 00:00:a8:cc:dd:73
    Destination: 00:00:a8:cc:dd:73 (
    Source: 00:0e:d6:aa:bb:3c (
    Type: ARP (0x0806)
    Trailer: 00000000000000000000000000000000...
    Frame check sequence: 0x1230f4a4 (correct)
Address Resolution Protocol (request)
    Hardware type: Ethernet (0x0001)
    Protocol type: IP (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: request (0x0001)
    Sender MAC address: 00:0e:d6:aa:bb:3c (
    Sender IP address: (
    Target MAC address: 00:00:a8:cc:dd:73 (
    Target IP address: (

All I know is that the is Cisco 6506 running IOS 12.2(17a)SX2.

Blue Bar separator
This page was last modified on 06-08-09
mailbox Send comments and suggestions