The Cache, and What It Will Believe
Gratuitous ARP, static entries, and why the protocol cannot say no
Step 1 of 2 — understand the idea. Read this first and the packet trace will confirm what you already expect, instead of teaching you two things at once.
What you'll be able to do
- ▸Explain what a gratuitous ARP is for and why it is not a request
- ▸Distinguish a dynamic cache entry from a static one
- ▸Say precisely what makes ARP spoofing possible, without overstating it
Before this lesson — it builds directly on:
ARP is four fields and a broadcast, and it was designed for a network where everybody plugged into the same wire was trusted. That assumption is in the protocol permanently: a reply carries no credential, and a host that receives one has no way to check it.
That is not a bug that was missed. It is a design from an era with different threats, and every defence against it has been added around the outside — in switches, in configuration, in monitoring — because the protocol itself cannot be changed without breaking every device that speaks it.
Watch these fields in the lab: arp.senderIp · arp.senderMac
- Dynamic entryglossary
- Learned from the wire — from a reply, or from an announcement nobody asked for. Ages out, and can be replaced by anything that arrives later.
- Static entry
- Configured by hand. Never learned, never aged, never overwritten. Immune to spoofing and a maintenance burden.
- Gratuitous ARP
- A message whose sender and target protocol addresses are the same. Used to announce yourself after a change, and to check whether anybody else already holds your address.
- Proxy ARP
- A router answering for an address that is not its own, so hosts believe a remote machine is local. Solves real problems and hides the subnet boundary, which makes faults harder to reason about.
✓ Concept check — before you open the packets
These test the idea, not the trace. You should be able to answer them from the explanation above.
Now that you understand the concept, observe how it appears in the packet exchange.
The lab runs a real simulated capture — pause, step, click any packet, and inspect every byte.