WhyZeroIPIsExcluded

A packet with both IPs 0.0.0.0 means nothing (it’s given ZeroIPsARPPacket and is part of the InvalidARPMessages), so it’s left out of this family: - A gratuitous ARP advertises a mapping, “this IP is at this MAC”, carried in Sender IP and Sender MAC. With Sender IP 0.0.0.0 there’s no address in it, so there’s no mapping for anyone to update, the same reason an ARPProbe updates no cache - It doesn’t ask anything either: Target IP 0.0.0.0 names no address to resolve, so it isn’t a probe or an ordinary request - So it’s invalid: ZeroIPsARPPacket in InvalidARPMessages

ARPTablesAndFilters gives 0.0.0.0 its own states when it compares the IPs, rather than counting it as equal, because it means something different in each IP field:

Without the exclusion, ZeroIPsARPPacket would count as gratuitous, as it does in Wireshark (see “By form or by purpose” above)