use tcpdump command .
 

[root@ad ~]# tcpdump -c 20 'ether dst ff:ff:ff:ff:ff:ff' -vv
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
21:10:59.798644 arp who-has 172.16.100.103 (Broadcast) tell 172.16.100.103
21:11:01.874895 arp who-has 172.16.100.103 (Broadcast) tell 172.16.100.103

my network setting.
[root@ad ~]# ip addr list
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 100
link/ether 00:0c:f1:a7:40:fb brd ff:ff:ff:ff:ff:ff
inet 192.168.234.11/24 brd 192.168.234.255 scope global eth1
inet6 fe80::20c:f1ff:fea7:40fb/64 scope link
valid_lft forever preferred_lft forever
3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 00:0c:f1:a7:40:fc brd ff:ff:ff:ff:ff:ff
inet 172.16.0.1/24 brd 172.16.0.255 scope global eth0
inet 172.16.100.103/24 brd 172.16.100.255 scope global eth0:1
inet6 fe80::20c:f1ff:fea7:40fc/64 scope link
valid_lft forever preferred_lft forever
4: sit0: <NOARP> mtu 1480 qdisc noop
link/sit 0.0.0.0 brd 0.0.0.0

172.16.100.103
what has found itself ?

thks!

I'm not certain what your question is. I'm assuming 172.16.100.103 is not the IP address of the system you are running the tcpdump on and you are questioning why 172.16.100.103 is asking everyone in earshot to respond if they have that IP address.

This is something that Microsoft, not normally known for innovation, actually implemented a long time ago. That system is probably just initializing its IP stack and is looking to see if someone is already using the IP address it would like to use.

Linux now does that too, I believe.

If that's not your question then this is not your answer, so restate. Thanks.