Question

During an intrusion investigation, an analyst opens a PCAP in Wireshark and examines an Ethernet frame carrying an ARP packet. The frame's destination MAC address is ff:ff:ff:ff:ff:ff and the ARP opcode field value is 1. What is the analyst observing at this point in the capture?

Accepted Answer

An ARP request being broadcast to all hosts on the local segment to resolve an IP address to a MAC address

Answer

An ARP reply being unicast back to the host that originally requested the MAC address

Answer

A gratuitous ARP announcement sent as a unicast to update a specific host's cache

Answer

An ICMP echo request broadcast used to enumerate live hosts on the subnet