[c-nsp] unusual arp behavior

[sthaug at nethelp.no]

> > Yes, a DHCP client is supposed to ask for an address first, but when it 
> > gets one it can try to arp for it with requestor IP 0.0.0.0 and refuse to 
> > use it if someone answers. This is called duplicate address detection, and 
> > is implemented by many DHCP clients.
> 
> Yes, as suggested by RFC 2131 section 4.4.1:
> 
>                    "For example, if the client is on a network that
>    supports ARP, the client may issue an ARP request for the suggested
>    request.  When broadcasting an ARP request for the suggested address,
>    the client must fill in its own hardware address as the sender's
>    hardware address, and 0 as the sender's IP address, to avoid
>    confusing ARP caches in other hosts on the same subnet."

Nevertheless, I believe the most common type of duplicate address
detection is simply ARPing for your own address, for instance:

19:56:04.846965 0:0:c0:e:69:cd ff:ff:ff:ff:ff:ff 0806 60: arp who-has 195.1.209.35 tell 195.1.209.35

Steinar Haug, Nethelp consulting, sthaug at nethelp.no