title: Unicast ARP Requests
body: <p>I captured in kali linux arp package with wireshark, and saw a arp who-has package with ethernet layer Dest is unicast and not broadcast. And I can't figure it out.</p>
  
  <p>Can someone explain how a arp who-has can be unicast?</p>
  
  <pre><code>eth.dst: 00:50:56:e3:28:0f
  eth.src: 00:0c:11:11:11:11
  eth.type: 0x0806
  
  arp.opcode: 1
  arp.src.hw_mac: 00:0c:11:11:11:11
  arp.src.proto_ipv4: 192.168.52.132
  arp.dst.hw_mac: 00:00:00:00:00:00
  arp.dst.proto_ipv4: 192.168.52.2
  </code></pre>
  
  <p>You can download the pcap file from <a href="https://mega.co.nz/#!K9pA0KKQ!LNmx4rGjZ52qQNLz3-BuX_Qv1TXMdkvLEFBxEUtVgN0" rel="nofollow">here</a>, see packet no. 3</p>
  
  <pre><code>kali's ifconfig: 
  ip: 192.168.52.132
  mac: 00:0c:11:11:11:11
  </code></pre>