Friday 24 August 2012

Can ARP Request be unicast ?

Yes ? Don't make that funny face :-) , i know in normal scenarios it is always broadcast. It has to be broadcast as it is used to get the mac address of the destination or the target. If you know mac address why you will send ARP request at the first place ?

All are correct but read this, as per RFC 1122:

(2)  Unicast Poll -- Actively poll the remote host by
                      periodically sending a point-to-point ARP Request
                      to it, and delete the entry if no ARP Reply is
                      received from N successive polls.  Again, the
                      timeout should be on the order of a minute, and
                      typically N is 2.
This is one of four mechanism to timeout the stale ARP entries.  

So if you are seeing in your network Unicast ARP Request, see if this is the case.

Any other case , i am not aware of , let me know if you any ...

Also one Linux tool is there which generates unicast ping request "Arpping".
But it first sends broadcast, get the mac address and changes subsequent requests to
unicast , its a tool .