While reviewing logs on my Ubiquiti Dream Machine recently, I noticed something odd — it was constantly sending ARPings out the WAN interface.
At first glance, this seemed unusual. ARP (Address Resolution Protocol) is typically used within a local network to map IP addresses to MAC addresses. Seeing it happen on the WAN interface — which is usually a direct link to my ISP — raised some eyebrows.
After some digging, my best guess is that Ubiquiti uses these ARPings as a way to monitor internet connection stability. It’s sending them to the default gateway provided by the ISP, possibly to verify link availability or detect when the connection drops. Some routers do this with ICMP (ping), but Ubiquiti seems to be doing it at Layer 2 instead.
Still, it feels a bit strange. You wouldn’t expect ARP traffic to be leaving the WAN side so frequently, but in this case, it appears to be by design.
