3

If a computer receives an ARP Reply frame not intended for it, will it update its ARP Table?

Example: A, B and C are connected physically and locally. A broadcasts ARP Request to ask for B's MAC then B replies. Will computer C, upon receiving the frame, update its own ARP Table with B's IP and MAC? Or will the frame be dropped since it wasn't intended for C originally?

IcySnow
  • 203
  • 2
  • 6
  • I have seen scenario where ARP requests would update the ARP cache. I don't recall all the details, but there was a network where ARP was broken for my laptop due to an RFC 1918 conflict and pinging an unused IP address would work around it because the ARP requests it produced would update the ARP cache of other devices. – kasperd Jan 07 '18 at 11:46
  • As _[RFC 826, An Ethernet Address Resolution Protocol](https://tools.ietf.org/html/rfc826)_ explains it, updating the ARP table whenever an ARP request or reply is seen will reduce the number of broadcasts on the network (a good thing) by reducing the need to send requests. – Ron Maupin Jan 07 '18 at 20:48

3 Answers3

4

An ARP reply is unicast unlike the broadcasted request. So on a switched network computer C should never receive the packet if all is operating well. Even if it did get the reply it shouldn't register the packet unless it is promiscuous mode (even then I don't think it would add it to the ARP table, you might get different behavior on different OSes though).

Kyle Brandt
  • 83,619
  • 74
  • 305
  • 448
1

Depends on the OS and configuration. Although normal ARP traffic would not reach C in a switched network, gratuitous ARP is sent to ethernet broadcast address so would reach all nodes.

It may be possible to configure the OS to either accept or ignore gratuitous ARP.

CGretski
  • 111
  • 2
0

Depends on the configuration of at least C, because this is basically ARP spoofing. But the same mechanism is also used by some HA/failover software.

One way to find out is to try. ;-)

Gnarfoz
  • 717
  • 4
  • 10