ByFieldsOrByPurpose

“Gratuitous” is defined two ways, and they don’t pick out quite the same packets.

By its fields - A gratuitous ARP is widely considered a packet defined by Sender IP = Target IP - This topic uses that definition but with the addition of excluding 0.0.0.0, because it’s the only definition that can be read off a single packet. - RFC5944 has “the ARP Sender Protocol Address and ARP Target Protocol Address are both set to the IP address of the cache entry to be updated” @ref=l/4119-4121 - RFC5944 has “A gratuitous ARP MAY use either an ARP Request or an ARP Reply packet” @ref=l/4118-4119 - Wireshark flags any request or reply whose sender and target protocol addresses match as gratuitous, without excluding 0.0.0.0 @ref

By its purpose: - A gratuitous ARP is unsolicited: one nobody asked for, sent to make other hosts update their caches. - RFC5944 defines it as a packet “sent by a node in order to spontaneously cause other nodes to update an entry in their ARP cache” @ref=l/457-459 - Whether a packet was asked for can’t be seen in the packet itself, only in what came before it.

An unsolicited reply with different IPs is gratuitous by purpose but not by its fields (since sender and target IPs are not equal). For example, an unsolicited reply telling one host that the gateway’s IP is at the sender’s MAC, as in ARPSpoofing, has the gateway’s IP as Sender IP and the victim’s as Target IP, so it falls in StandardARPMessages as a StandardARPResponse

A solicited reply with equal IPs is gratuitous by its fields but not by purpose. A host already owning an address that answers a gratuitous request for it the RFC826 way puts its own address in Sender IP and the asker’s Sender IP, the same address, in Target IP. That makes it a UnicastGratuitousARPReply, though it was asked for