Behavior of Gratuitous ARP in Windows NT 4.0

This article was previously published under Q199773
This article has been archived. It is offered "as is" and will no longer be updated.
This information applies to Windows NT 4.0 with Service Pack 3 or higher installed.

Statically Addressed Computers

When starting, a statically addressed Windows NT computer will perform a gratuitous ARP up to 3 times: 1 time when the TCP/IP stack initializes, and 2 more times after .5 and 1 second intervals, if no response is received.

Whenever a statically configured IP address is changed (for example, using the Network tool in Control Panel), Windows NT sends a single gratuitous ARP.

If Windows NT receives a response to a gratuitous ARP, it disables the interface that issued the gratuitous ARP, generates an event (event ID 26), and generates a pop-up dialog box on the console warning the user that a duplicate IP address has been detected resulting in the shutdown of the affected interface.

DHCP-Addressed Computers

Any time a DHCP lease is obtained, Windows NT sends a single gratuitous ARP.

If Windows NT receives a response to this gratuitous ARP, it sends a DHCP DECLINE message to the DHCP server, and then attempts to obtain another lease.

Windows NT Response to IP Address Conflict

If Windows NT receives a gratuitous ARP for its own IP address, it generates an event (event ID 26), generates a pop-up dialog box on the console warning the user that a duplicate IP address has been detected, but does not shut down the affected interface. It then sends a gratuitous ARP to make sure that the offending computer has shut down its interface.
Gratuitous ARP, also called a courtesy ARP, is a mechanism used by TCP/IP computers to "announce" their IP address to the local network and, therefore, avoid duplicate IP addresses on the network. Routers and other network hardware may use cache information gained from gratuitous ARPs.

It is possible, if a machine issues a gratuitous ARP but is not challenged, that two computers on the network might be simultaneously using the same IP address. In this case, packet routing (particularly on switches with VLANs) could be diverted from the original holder of the IP address to the new holder as ARP caches are updated on the router.

This is likely to be a problem only on networks where there are a high number of errors or lost packets, or where latency is high (above .5 second).

One other circumstance can cause this problem. Most switches use a spanning tree algorithm to build tables of media access control address <--> port number associations. While the spanning tree is reconfigured, there is typically a short delay, during which time the client might not have full connectivity. Unfortunately, this delay usually occurs about the time the switch becomes aware of the client, which is usually the time when the client's network stack is initializing (and gratuitous ARPs are being sent).

To overcome this problem, some switch manufacturers have implemented a software setting that causes the switch to treat new clients as broadcast clients (like a hub) until the spanning tree is fully reconfigured.

This aspect of switches can have other side effects. For additional information, see the following article or articles in theMicrosoft Knowledge Base:
168455 DHCP Renewal Failures on Switched Networks

Article ID: 199773 - Last Review: 12/05/2015 10:24:56 - Revision: 2.3

Microsoft Windows NT Server 4.0, Terminal Server Edition, Microsoft Windows 2000 Server, Microsoft Windows 2000 Advanced Server, Microsoft Windows 2000 Professional Edition, Microsoft Windows NT Server 4.0 Standard Edition, Microsoft Windows NT Workstation 4.0 Developer Edition, Microsoft Windows NT Server 4.0 Enterprise Edition

  • kbnosurvey kbarchive kbinfo kbnetwork KB199773