Revision history  [back]

An ARP request packet is used to map an IP address (Layer 3) to Mac address (Layer 2). When the mapping is unknown, you will see an ARP packet sent to the broadcast mac-address ff:ff:ff:ff:ff:ff. When the requester does already know the mapping, it will send a unicast ARP packet to the already known mac-adress to verify if that mac-address is still using the requested IP address.

In your case it's a unicast destination mac-address, meaning the router still knows the mac-address that uses the IP address 73.207.128.1. But it is verifying that it can continue to use the mac-adress "Cadant_6f:68:46" to send traffic to this IP address. As you said that this IP address is the same as your public-IP apart from the last octet, I assume this address is the gateway address your router received from your ISP to use when sending packetss to the Internet.

What is not normal bout this packet is that it uses the IP adress of the LAN/WiFi interface of your router. But I guess you see these ARP requests on the LAN/WiFi side of the router. In that case it would be correct to use this IP address, but then it is strange that it tries to find the gateway of your provider on the LAN/WiFi side of your network. It should be looked for on the WAN side of your router.

My guess is that your router sends out the ARP request for 73.207.128.1 on all of it's network segments (both the WAN side as the LAN/WiFi side). It will (and should) only receive an ARP response on the WAN side and will update the idle-timer of the ARP entry in its ARP cache.