A Digital Garden - frequent growth but a bit weedy in the back corner
tldr: Without the exclusion, ZeroIPsARPPacket would fall into GratuitousARPMessages rather than InvalidARPMessages
A packet with both IPs 0.0.0.0 means nothing (it’s given ZeroIPsARPPacket and is part of the InvalidARPMessages), so it’s left out of this family:
0.0.0.0 there’s no address in it, so there’s no mapping for anyone to update, the same reason an ARPProbe updates no cache0.0.0.0 names no address to resolve, so it isn’t a probe or an ordinary requestARPTablesAndFilters gives 0.0.0.0 its own states when it compares the IPs, rather than counting it as equal, because it means something different in each IP field:
| IPs | Meaning | Family |
|---|---|---|
equal, not 0.0.0.0 |
a host telling others about its own address | GratuitousARPMessages |
sender 0.0.0.0 |
a probe from a host with no address yet | ARPProbeMessages |
target 0.0.0.0 |
a reply to a probe | ARPProbeReplyMessages |
both 0.0.0.0 |
nothing | InvalidARPMessages |
Wireshark classifies ZeroIPsARPPacket as ‘Gratuitous ARP’ (see ByFieldsOrByPurpose)