Gratuitous Address Resolution Protocol (GARP) is a network packet broadcast used by a device to announce its own IP-to-MAC address mapping to the rest of the local network. Unlike standard ARP, which queries another node for its hardware address, a GARP message is unsolicited. It tells every neighboring host and switch to update their ARP caches immediately, ensuring seamless traffic flow when network topologies shift or virtual IP addresses move.
On Cisco IOS platforms, configuring and managing how devices handle GARP packets is essential for high availability, security hardening, and troubleshooting communication drops. Whether you're managing failover clusters or preventing ARP cache poisoning, understanding how to control GARP behavior directly impacts network stability.
How Gratuitous ARP Works Under the Hood
Standard ARP resolves an unknown MAC address by broadcasting a request: "Who has this IP address? Tell my IP." A GARP packet flips this logic entirely. The sender broadcasts a packet where both the source and target IP addresses are set to the sender's own IP address.
When a Cisco router or local switch port receives this broadcast, it evaluates the mapping. If the IP address already exists in its ARP table with a different MAC address, the device overwrites the old entry with the new hardware address. If no entry exists, it populates a new one.
GARP packets typically manifest as either an ARP request or an ARP reply. Many operating systems and network devices utilize ARP requests for GARP, while others rely on ARP replies. Regardless of the frame type, the core mechanism remains identical: updating local neighbor tables without waiting for a prompt.
Core Use Cases in Enterprise Networks
Network administrators rely on GARP for several critical operational scenarios. Recognizing these use cases helps clarify why tuning GARP parameters on Cisco equipment matters.
- High Availability and Router Redundancy: Protocols like Hot Standby Router Protocol (HSRP) or Virtual Router Redundancy Protocol (VRRP) use GARP when a standby router takes over a virtual IP address. The newly active router immediately fires a GARP broadcast so local hosts redirect their traffic to the new physical MAC address.
- IP Conflict Detection: When a device boots up or acquires a new IP address via DHCP, it often sends a GARP probe. If another host responds, an IP conflict is flagged, preventing duplicate IP assignments on the broadcast domain.
- Switch MAC Table Refresh: Switches map switchports to MAC addresses, not IP addresses. When a server changes its network interface card or migrates to a new host, a GARP broadcast ensures intermediate switches update their content-addressable memory (CAM) tables instantly.
- Link State Changes: When an interface bounces or reconnects after an outage, the device often emits a GARP frame to notify adjacent systems that the link is live and ready to process packets.
Configuring GARP Control on Cisco IOS
Cisco IOS allows administrators to control how routers and switches process incoming GARP packets globally. By default, most modern Cisco devices process local GARP messages, but security policies often require tightening these rules to mitigate spoofing risks.
To configure global GARP control behavior, enter global configuration mode on your Cisco device:
Router# configure terminal
Router(config)# ip arp gratuitous local
The ip arp gratuitous command accepts three primary arguments that dictate router behavior:
- local: Instructs the device to accept and process only local gratuitous ARP packets originating from the same subnet. This blocks off-link spoofing attempts while retaining redundancy functionality.
- none: Rejects all gratuitous ARP control processing entirely.
- ignore: Completely drops and ignores all received gratuitous ARP packets without updating tables.
To revert to default settings or remove the explicit constraint, use the negation command:
Router(config)# no ip arp gratuitous
You can verify your current interface and global ARP configurations using standard Cisco IP Addressing Commands:
Router# show ip arp
Security Risks and Mitigation Strategies
Because GARP packets are unauthenticated by nature, malicious actors can exploit them. An attacker on the local segment can craft forged GARP frames claiming the IP address of the default gateway belongs to the attacker's MAC address. This forces all client traffic through the attacker's machine, enabling Man-in-the-Middle (MitM) attacks.
To protect your Cisco switching infrastructure against GARP-based cache poisoning, implement Dynamic ARP Inspection (DAI). DAI leverages Cisco Catalyst Switching Features alongside DHCP snooping to validate every ARP packet against trusted bindings.
- Enable DHCP snooping globally on the switch to build a valid database of IP-to-MAC bindings.
- Trust uplink ports connected to legitimate routers and switches.
- Enable DAI for specific VLANs to intercept and drop invalid or unverified GARP frames:
Switch(config)# ip arp inspection vlan 10
Switch(config)# interface gigabitethernet 0/1
Switch(config-if)# ip arp inspection trust
Enabling DAI ensures that unauthorized GARP broadcasts attempting to alter gateway bindings are dropped before they pollute neighbor tables.
Common Configuration Mistakes
Mismanaging GARP settings often leads to intermittent connectivity issues during network failovers. Avoid these frequent pitfalls:
- Disabling GARP globally in high-availability environments: Setting
ip arp gratuitous ignoreon routers participating in HSRP will break failover mechanics. The backup router will take over the virtual IP, but clients won't update their ARP caches, resulting in blackholed traffic. - Ignoring rate-limiting on edge ports: Uncontrolled ARP broadcasts from misconfigured virtual machines can overwhelm CPU queues. Pair your ARP policies with rate limits on untrusted ports using
ip arp inspection limit. - Assuming cross-subnet GARP works natively: GARP packets are Layer 2 broadcasts. Routers do not forward broadcast traffic across subnets by default, meaning GARP messages only affect devices residing on the immediate local broadcast domain.
Frequently Asked Questions
What is the difference between an ARP announcement and a Gratuitous ARP?
An ARP announcement is strictly an ARP request packet (Opcode 1) configured with the sender's IP and MAC mapping, designed solely to update caches without expecting a reply. A Gratuitous ARP can be implemented as either a request or a reply (Opcode 2) depending on the vendor operating system. Both achieve the same functional outcome of refreshing peer ARP tables.
Why are my hosts failing to update their ARP tables during an HSRP failover?
This usually happens if an upstream firewall or security switch drops unexpected ARP replies, or if the router's global GARP parameter is set to ignore. Ensure your active redundancy interfaces are permitted to broadcast updates and that intermediary switches don't block gratuitous frames.
Does Gratuitous ARP cross VLAN boundaries?
No. Because GARP relies on Layer 2 broadcast frames (destination MAC ff:ff:ff:ff:ff:ff), routers drop the broadcast at the Layer 3 boundary. GARP updates only affect devices within the exact same VLAN or broadcast domain.
How can I check if my Cisco router is processing incoming GARP packets?
You can run packet captures using embedded packet capture (EPC) on the router interface or inspect the ARP table entries dynamically using show ip arp while triggering a known state change on a redundant peer.
