Gratuitous ARP (GARP) can be used by any node to advertise its own MAC address with the respective IP address as the ARP reply, even when there is no ARP request. The primary purpose for such advanced notification is to ensure that the neighbors' ARP caches are updated on any changes in the local MAC address. GARP will always be destined to broadcast the MAC address:
GARP packet
While it is expected to see GARP in a production environment, it could also be used by any malicious attacker to eavesdrop by sending GARP with its own MAC address for any IP address:
GARP filter
arp.isgratuitous is a Wireshark display filter that helps ...
