Table of Contents
Purpose of Gratuitous ARP
Gratuitous ARP is a special kind of ARP message that a device sends without having been asked. In normal ARP, a device sends a request to find the MAC address for a known IP. In gratuitous ARP, the device already knows both the IP and the MAC, and it simply announces, "This IP belongs to this MAC."
The main purpose is not to discover information, but to update or correct information in other devices on the same local network. It is a way to refresh ARP caches, detect certain conflicts, and support features such as failover and load balancing.
Gratuitous ARP uses an ARP request or reply where the sender IP and the target IP are the same. The message is generally sent to the broadcast MAC address, so all hosts on the LAN can see and potentially update their ARP tables.
Structure and Behavior
In a gratuitous ARP, the ARP header fields have some special characteristics. Compared with a typical ARP request, the target protocol address and the source protocol address contain the same IP. For example, a host with IP 192.168.1.10 and MAC 00:11:22:33:44:55 might send:
Source IP: 192.168.1.10
Source MAC: 00:11:22:33:44:55
Target IP: 192.168.1.10
Target MAC: 00:00:00:00:00:00 (in a request)
The Ethernet frame is usually sent to the broadcast MAC address ff:ff:ff:ff:ff:ff. Every host on the LAN receives this broadcast and can update its ARP cache entry for 192.168.1.10 to map to 00:11:22:33:44:55.
Some implementations use an ARP reply instead, still sent as a broadcast, where the sender IP and target IP are the same. The effect is similar, other hosts see the packet and can update their ARP entries.
Key point: In gratuitous ARP, the sender IP equals the target IP. The packet is broadcast so every host on the LAN can refresh or correct their ARP cache for that IP.
Typical Uses of Gratuitous ARP
Gratuitous ARP appears in several common situations on modern networks. It is often automatic and requires no user configuration.
One common use is ARP cache updating when a device first comes online. When a host boots and configures its IP address, it may send one or more gratuitous ARP packets. Other devices that still hold an old ARP entry, perhaps with a different MAC address, can replace that entry with the new mapping. This helps keep ARP tables in switches, routers, and hosts accurate.
Another important use is in high availability and failover. In many clusters and redundant setups, a virtual IP address is shared between two or more devices. Only one device is active at a time. When the active device fails and a standby node takes over the IP address, the new owner sends gratuitous ARP messages. This quickly informs all neighbors that the IP now maps to a different MAC. Traffic that was previously going to the failed node is immediately redirected to the new active node.
Gratuitous ARP is also used after certain network changes. If a network card is replaced, if a virtual machine moves between hypervisors, or if a link switches from one interface to another, the MAC address for a given IP can change. A gratuitous ARP lets the network learn the new placement without waiting for normal ARP traffic.
IP Conflict Detection
Gratuitous ARP can help detect IP address conflicts on a LAN. When a host chooses or is given an IP address, it can send a gratuitous ARP to see if anyone else is already using that IP.
The logic is simple. The host broadcasts an ARP message that says, "IP X is at MAC Y." If another device on the network already uses IP X, that device may respond or log a conflict. Some operating systems monitor incoming ARP packets, and if they see a gratuitous ARP from another MAC for their own IP, they detect a conflict and can alert the user or disable the address.
Some hosts interpret an ARP reply to their own gratuitous ARP as a sign that the IP is already in use. They can then avoid using that IP and attempt to get a different address.
Important behavior: If a host sees an ARP entry for its own IP but with a different MAC, it indicates an IP address conflict. Gratuitous ARP helps detect this condition early.
Role in Failover and Load Balancing
Many high availability designs rely directly on gratuitous ARP. These designs often use a shared or virtual IP that moves between devices. Examples include router redundancy pairs and clustered servers.
When the active device fails, the backup device assigns the same IP to one of its interfaces. Neighbors still have ARP entries pointing to the MAC of the failed device. Without intervention, packets would continue to be sent to the wrong MAC and be lost. To avoid this, as soon as the backup device becomes active, it sends gratuitous ARP messages for the shared IP. Each neighbor then updates its ARP cache to map the shared IP to the new MAC. Convergence in this case can be very quick, sometimes almost instant from the client's point of view.
Load balancers also make use of similar techniques. A load balancer that presents one virtual IP on behalf of multiple real servers can periodically send gratuitous ARPs so that all clients and intermediate devices know which MAC corresponds to that virtual IP. This is especially helpful in virtualized environments where virtual machines can move across different physical hosts, and therefore their MAC addresses might appear on different switch ports.
Gratuitous ARP can therefore be viewed as a tool to quickly redirect traffic when the relationship between an IP and a MAC changes, especially in clustered or virtual setups.
Interaction with Switches
Switches maintain a table that maps MAC addresses to switch ports. They learn these mappings by inspecting the source MAC address of frames they receive. Gratuitous ARP plays a role here as well.
When a device sends a gratuitous ARP broadcast, the switch sees the frame and updates its MAC address table to map the source MAC to the port where the frame arrived. This is useful when a device that owns an IP address moves to another physical switch port, such as a virtual machine migrating between hosts or a cable being moved.
If the switch had an old entry that mapped the MAC to another port, the gratuitous ARP frame causes the switch to correct the mapping. This reduces the period during which the switch would flood frames destined for that MAC or send them to the wrong port.
The same idea supports failover in redundant topologies. When the active device for a shared IP changes, it sends gratuitous ARP frames. Switches update their MAC tables for the MAC address of the new active device, so unicast traffic headed to that MAC can reach the correct port without delay.
Security Considerations
Gratuitous ARP is useful, but it can also be abused. Because any host on a LAN can send gratuitous ARP packets that claim "IP X is at MAC Y," an attacker can send false announcements and trick other hosts into updating their ARP caches with incorrect mappings.
This attack is often called ARP spoofing or ARP poisoning. The attacker sends crafted gratuitous ARPs to convince victims that important IP addresses, such as the default gateway, map to the attacker's MAC address. Traffic intended for the gateway then passes through the attacker, who can inspect, modify, or drop packets.
Because normal hosts trust ARP information by design, gratuitous ARP does not include authentication. Without additional security features, any device on the same broadcast domain can influence the ARP tables of others.
Security risk: Gratuitous ARP can be used for ARP spoofing. A malicious host can send false ARP announcements to redirect traffic. Networks often mitigate this with features such as dynamic ARP inspection, static ARP entries for critical devices, or strict port security.
Understanding gratuitous ARP therefore includes understanding that it is both a helpful mechanism for fast convergence and a potential vector for local network attacks. Network security tools and switch features often monitor or control gratuitous ARP behavior to balance availability with security.