I want to identify a gratuitous ARP.
Can I say: If sender IP address and target IP address equal, it's always a gratuitous ARP?
I want to identify a gratuitous ARP.
Can I say: If sender IP address and target IP address equal, it's always a gratuitous ARP?
You can identify Gratuitous ARPs by looking at the ARP Sender Protocol Address and ARP Target Protocol Address, so as you mentioned when they are the same it's a gratuitous ARP. See RFC 2002, Section 4.6 for a reference (the emphasis - !!!!>
and <!!!!
is mine)...
4.6. ARP, Proxy ARP, and Gratuitous ARP
<...>
A Gratuitous ARP [23] is an ARP packet sent by a node in order to
spontaneously cause other nodes to update an entry in their ARP
cache. A gratuitous ARP MAY use either an ARP Request or an ARP
Reply packet. In either case, the (!!!!>) ARP Sender Protocol Address
and ARP Target Protocol Address are both set to the IP address
of the cache entry to be updated (<!!!!), and the ARP Sender Hardware
Address is set to the link-layer address to which this cache
entry should be updated. When using an ARP Reply packet, the
Target Hardware Address is also set to the link-layer address to
which this cache entry should be updated (this field is not used
in an ARP Request packet).
In either case, for a gratuitous ARP, the ARP packet MUST be
transmitted as a local broadcast packet on the local link. As
specified in [16], any node receiving any ARP packet (Request or
Reply) MUST update its local ARP cache with the Sender Protocol
and Hardware Addresses in the ARP packet, if the receiving node
has an entry for that IP address already in its ARP cache. This
requirement in the ARP protocol applies even for ARP Request
packets, and for ARP Reply packets that do not match any ARP
Request transmitted by the receiving node [16].