 | 1 | initial version |
It's a choice. Historiclly it was common to learn ARP as soon as you got a packet. As everyting what you need is in the SYN packet as soon as it arrives there is no point to ask for it it return a SYN/ACK packet.
Historically this make a lot of send if you have a lot of systems in 1 collision domain. But times have changed and so is the size of the average collision domain. So now you (sometimes) see both ends do ARP request for just a single TCP connection.
I understand this migh look akward but that is the way I have seen ARP packet change over the years.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
