In this demonstration, using Wireshark live packet capture,
I will show examples of how and when gratuitous ARP is used.
First,
we'll see a GARP request when a disabled host network card
is enabled and it comes on the network.
Then you'll see how gratuitous ARP replies come from a Cisco
router acting as the default-gateway for the LAN when
entries in its ARP cache refresh.
After dissecting the gratuitous ARP packet details,
I will show you how a simple router redundancy scenario is set up.
For this, I'll use Cisco routers in the Hot Standby Router Protocol.
Once it's working,
I'll pull the connection and we'll see how gratuitous ARP
helps in the default-gateway failover process.
To be able to examine gratuitous ARP's packet details,
I'm going to start a Wireshark capture on my ethernet network card.
I'm also going to limit what we can see by putting in an ARP display filter.
In our presentation,
you'll learn that gratuitous ARPs are generated under certain conditions,
one of those is when a NIC changes state.
Since gratuitous ARP is a broadcast,
I should be able to capture if any system on my network comes online.
I'm going to activate a disabled NIC of another computer in the LAN.
Immediately, that network card starts generating traffic.
One of the first jobs a network card has to do when it comes online and gets
assigned an IP address is to do duplicate IP address detection.
In a later section and demonstration,
we'll take a look at how ARP is used to detect and mitigate
duplicate IP address problems on the network,
but right now, let's take a look at how gratuitous ARP works.
Immediately, I can see a gratuitous ARP request.
Let's highlight that packet and stop my capture for now.
I'm going to expand the ethernet sections and the address resolution
protocol header so that we can look at the packet details.
The first thing to notice is the ethernet header shows that this is
a broadcast frame coming from my Dell computer which had its
network card disabled and came on the LAN.
If we look at the address resolution protocol header,
we can see this is an address resolution protocol
request and it says gratuitous ARP.
The hardware type is, of course, our ethernet network,
the protocol type is our IPv4 Layer-3 addressing,
our hardware size is again our MAC address,
6 bytes, and our protocol size is our IP address size of 4 bytes.
Now the opcode sets this as a request with the 1 and Wireshark has
marked this in the square brackets as a gratuitous ARP.
The reason why Wireshark detects it and other systems detect this as a
gratuitous ARP is the fact that it has the center IP address and the target
IP address set to the IP address of the sender.
In this case, since it's a request, the target MAC address is set to all zeros.
As this is a gratuitous ARP request,
it was not solicited by anyone else and its purpose is to announce
the IP and MAC address binding to the network.
Now that we've seen a gratuitous ARP request,
let's take a look at a gratuitous ARP reply.
In my experience,
these are most commonly generated by routers to make sure that the LAN
is updated to the location of the default-gateway.
A default-gateway is going to generate a gratuitous
ARP reply under certain conditions,
one of those is when ARP cache entries time out.
To make sure, I can capture my gratuitous ARP reply from my router.
I'm going to restart my Wireshark capture.
I'm going to bring up my router interface,
log in, and I'm going to show my ARP cache.
Here, I can see the MAC addresses and IP addresses of the systems in the network.
When these entries are cleared out,
the router will naturally generate a gratuitous ARP reply
to update the network to its location.
To clear its ARP cache, I'm going to type clear arp-cache interface f0/0,
the 1 servicing my LAN.
Let's go back to my Wireshark and look for our
gratuitous ARP reply from the router.
Here, I've highlighted that gratuitous ARP reply.
We can see again, it's a broadcast frame going out to everyone on the LAN,
but the source now is the Cisco router.
Even though the opcode is set to 2 for reply and the target
MAC address is set to a broadcast of all Fs,
what makes this a gratuitous ARP is the fact that the sender and
target IP addresses are the same and the intent is for this to update
the ARP caches and the switch MAC address tables on the network to the location of the default-gateway.