Question about ARP protocol

edit

It's a choice. Historiclly it was common to learn ARP as soon as you got a packet. As everyting what you need is in the SYN packet as soon as it arrives there is no point to ask for it it return a SYN/ACK packet.

Historically this make a lot of send if you have a lot of systems in 1 collision domain. But times have changed and so is the size of the average collision domain. So now you (sometimes) see both ends do ARP request for just a single TCP connection.

I understand this migh look akward but that is the way I have seen ARP packet change over the years.

It's difficult to see with all the 1's in the IP address.
Packets #1 and #2 are probably the ".11" node asking where the ".1" node before sending a ping.

Packet #15 and #16 are ".1" asking where ".11" is in order to send a ping response.
(Guessing that is ping traffic based on the rest of the packets in the list.)

#1: Who has 192.168.1.1? Tell 192.168.1.11
#2: 192.168.1.1. is at 08:00:27:e9:b4:2f

#15 Who has 192.168.1.11? Tell 192.168.1.1
#16: 192.168.1.11 is at 08:00:27:ef:bf:5e

If the nodes are on a /24 network the ping traffic is probably going through 192.168.1.1 to reach 192.168.2.21.