Skip to content
  • John Thacker's avatar
    fee53310
    ARP: Detect ARP Probes with non-zero dst addr, warn · fee53310
    John Thacker authored and AndersBroman's avatar AndersBroman committed 
    RFC 5227, 2.1.1 Probe Details:

"The 'target hardware address' field is ignored and SHOULD be set to
all zeroes... An ARP Request constructed this way, with an all-zero
'sender IP address', is referred to as an 'ARP Probe'."

So interpret any ARP Request with an all-zero sender IP address as
an ARP Probe, but add an expert warning of non-compliance with the
RFC SHOULD if the target hardware address field is not all zeroes.

Fix #20428
    fee53310
    ARP: Detect ARP Probes with non-zero dst addr, warn
    John Thacker authored and AndersBroman's avatar AndersBroman committed 
    RFC 5227, 2.1.1 Probe Details:

"The 'target hardware address' field is ignored and SHOULD be set to
all zeroes... An ARP Request constructed this way, with an all-zero
'sender IP address', is referred to as an 'ARP Probe'."

So interpret any ARP Request with an all-zero sender IP address as
an ARP Probe, but add an expert warning of non-compliance with the
RFC SHOULD if the target hardware address field is not all zeroes.

Fix #20428