ARP (Address Resolution Protocol) explained

Hello David

The behavior is a matter of the particular host’s NIC operating mode: Normal or Promiscuous mode.

In normal mode, which is typically the default operating mode, a NIC only processes packets addressed to its own MAC address, as well as broadcast packets and multicast packets for which the NIC is specifically configured to listen. In this mode, when a NIC receives an ARP request that is broadcast, it will open it and take a look at the target IP address (the IP address for which the request wants to learn the corresponding MAC address). If that address is not its own, it will not process the request any further, and it will discard it. Even though the sender MAC and IP are available to it, it will not populate its ARP.

In promiscuous mode, the NIC processes all packets it sees on the network, regardless of the destination MAC address. It effectively “listens” to all the traffic in its network segment. If it receives an ARP request, it will look at the sender’s IP and MAC addresses and use that information to populate its ARP table.

Now what mode is the default, and what mode you are able to configure depends upon the host in question. On a Windows device, promiscuous mode is typically controlled by software applications that may require it. For example, Wireshark can be configured to use promiscuous mode to listen to and process packets arriving on a NIC.

I hope this has been helpful!

Laz