MIKE HIGGINBOTTOM

A Digital Garden - frequent growth but a bit weedy in the back corner

WhyZeroIPIsExcluded

tldr: Without the exclusion, ZeroIPsARPPacket would fall into GratuitousARPMessages rather than InvalidARPMessages

A packet with both IPs 0.0.0.0 means nothing (it’s given ZeroIPsARPPacket and is part of the InvalidARPMessages), so it’s left out of this family:

ARPTablesAndFilters gives 0.0.0.0 its own states when it compares the IPs, rather than counting it as equal, because it means something different in each IP field:

IPs Meaning Family
equal, not 0.0.0.0 a host telling others about its own address GratuitousARPMessages
sender 0.0.0.0 a probe from a host with no address yet ARPProbeMessages
target 0.0.0.0 a reply to a probe ARPProbeReplyMessages
both 0.0.0.0 nothing InvalidARPMessages

Wireshark classifies ZeroIPsARPPacket as ‘Gratuitous ARP’ (see ByFieldsOrByPurpose)