When a host sends an ARP request to resolve its own IP address it is called gratuitous ARP. A gratuitous ARP request is sent with the following parameters:
Detect duplicate IP address.
In a properly configured network, there is no ARP reply for a gratuitous ARP request. However, if another host in the network is configured with the same IP address as the source host, then the source host receives an ARP reply.
Announce that an IP address has moved or bonded to a new network interface card (NIC).
If you change a system NIC, the MAC address to its IP address mapping also changes. When you reboot the host, it sends an ARP request packet for its own IP address. All of the hosts in the network receive and process this packet. Each host updates their old mapping in the ARP table with this new mapping
Notify a Layer 2 switch that a host has moved from one port to another port.
However, hosts can launch man-in-the-middle attacks by sending out gratuitous ARP requests for the router's IP address. This results in hosts sending their router traffic to the attacker, and the attacker forwarding that data to the router. This allows passwords, keys, and other information to be intercepted.
To protect against this type of attack, the router sends out its own gratuitous ARP request to override the attacker whenever a gratuitous ARP request broadcast packet with the router's IP address as the source is received on the network.
If you enable both DHCP (Dynamic Host Configuration Protocol) secured ARP and gratuitous ARP protection, the switch protects its own IP address and those of the hosts that appear as secure entries in the ARP table.
Print
this page
Email this topic
Feedback
View PDF
Download EPUB