Huafeng Lu writes: > sender's Ether addr: 0003 ba45 a43f > sender's IP addr: 0000 0000 (this host on this net, which I think means > "myself")
Not exactly. In this case, it means "no IP address." This is an ARP probe packet, which is used for duplicate address detection. > 0: ffff ffff ffff 0003 ba45 a43e 0806 0001 .........E????>.... > 16: 0800 0604 0001 0003 ba45 a43e 0a0c 0d01 .........E????>.... > 32: ffff ffff ffff 0a0c 0d01 That's known as a gratuitous ARP. It's an ARP "request" sent with the sender's IP address both as sender and target. It's used to flush out any stale ARP entries in peer nodes once we've determined that the IP address is legitimately ours. > These two packet were captured by snoop in the same session. My question > is, what's the difference between these two? When will they be sent out, > respectively? Thanks. The difference is as above. The probe will be sent when the interface is first configured and we're trying to determine whether anyone else on the network is already using that address. The zero IP sender address makes sure that we don't accidentally pollute someone else's cache while doing this. The gratuitous announcement comes when we've determined that there is no such conflict, when the interface changes in some way (as with IPMP fail-over), or when we feel like it. It does two things: it updates any stale caches other peers may have, and it flushes latent conflicts out into the open. -- James Carlson, KISS Network <[EMAIL PROTECTED]> Sun Microsystems / 1 Network Drive 71.232W Vox +1 781 442 2084 MS UBUR02-212 / Burlington MA 01803-2757 42.496N Fax +1 781 442 1677 _______________________________________________ networking-discuss mailing list [email protected]
