ByFormOrByPurpose

“Gratuitous” is defined two ways, and they don’t pick out quite the same packets.

By form, a gratuitous ARP is one whose Sender IP and Target IP are the same. RFC5944 §4.6 has “the ARP Sender Protocol Address and ARP Target Protocol Address are both set to the IP address of the cache entry to be updated”, and “A gratuitous ARP MAY use either an ARP Request or an ARP Reply packet” @ref. Wireshark flags any request or reply whose sender and target protocol addresses match as gratuitous, without excluding 0.0.0.0 @ref. This topic uses the form, excluding 0.0.0.0, because it’s the only definition that can be read off a single packet.

By purpose, a gratuitous ARP is unsolicited: one nobody asked for, sent to make other hosts update their caches. RFC5944 §1.6 defines it as a packet “sent by a node in order to spontaneously cause other nodes to update an entry in their ARP cache” @ref. Whether a packet was asked for can’t be seen in the packet itself, only in what came before it.

The two disagree in both directions: - An unsolicited reply with different IPs is gratuitous by purpose but not by form. A reply telling one host that the gateway’s IP is at the sender’s MAC, as in ARPSpoofing, has the gateway’s IP as Sender IP and the victim’s as Target IP, so it falls in StandardARPMessages as a StandardARPResponse - A solicited reply with equal IPs is gratuitous by form but not by purpose. A host already owning an address that answers a gratuitous request for it the RFC826 way puts its own address in Sender IP and the asker’s Sender IP, the same address, in Target IP. That makes it a UnicastGratuitousARPReply, though it was asked for