Wireshark · Ethereal-users: RE: [Ethereal-users] Duplicate IP Addresses!

[Jeff Parker <jparker@xxxxxxxxxxxx>]

> I wondered about that.  I have seen two types of behavior.  
> One is what you describe above, where a recipient implicitly 
> updates its ARP table upon receipt of a packet with a new MAC.  
> The other is where a host will only update its ARP table if 
> it receives an actual ARP reply from a request that
> the host itself made.  

There is an intermediate mode that is common: you update
the ARP table on any ARP reply, though not on other packets.
This behavior is common enough that gratuitous ARP uses
it to alter ARP bindings.  Stevens, TCP/IP Illustrated 
vol. 1 has a discussion.  

- jeff parker
- axiowave networks