To better understand the concepts of ARP's broadcasting and unicasting, let's take a look at the ARP packet captured on a real network by Wireshark. The address information is as follows (partial MAC addresses are shielded):
PC1 <---> PC2
PC1: IP1: 10.1.20.64 MAC1: 00:08:ca:xx:xx:xx
PC2: IP2: 10.1.20.109 MAC2: 44:6d:57:xx:xx:xx
ARP request
ARP reply
ARP fields
Hardware type: identifies the link layer protocol.
Protocol type: identifies the network layer protocol.
Hardware size: identifies the length of the MAC address. Here, the value is 6 bytes (48 bits).
Protocol size: identifies the length of the IP address. Here, the value is 4 bytes (32 bits).
Opcode: identifies the type of the ARP packet. 1: request; 2: reply.
Sender MAC address: indicates the MAC address of the sender.
Sender IP address: indicates the IP address of the sender.
Target MAC address: indicates the destination MAC address. The value contains only 0, indicating that it is unknown.
Target IP address: indicates the destination IP address.
