A while ago I was writing about the behavior of Microsoft’s Network Load Balancing, the problems it’s causing and how Microsoft tried to hack around them using multicast MAC addresses as the hardware address of sender in ARP replies (which is illegal). A few days ago one of my readers asked me whether I know which RFC prohibits the use of multicast MAC address in ARP replies.
A quick consultation with friendly Google search engine returned this web page, which contained the answer: section 3.3.2 of RFC 1812 (Requirements for IP Version 4 Routers):
A router MUST not believe any ARP reply that claims that the Link Layer address of another host or router is a broadcast or multicast address.
Problem solved – now I know the real reason we have to configure static ARP entries on Cisco routers and switches.
Source: http://blog.ioshints.info/2012/05/arp-reply-with-multicast-source-mac-is.html