ARPing

Description

Arping is a util to find out it a specific IP address on the LAN is ‘taken’ and what MAC address owns it. Sure, you *could* just use ‘ping’ to find out if it’s taken and even if the computer blocks ping (and everything else) you still get an entry in your ARP cache. But what if you aren’t on a routable net? Or the host blocks ping (all ICMP even)? Then you’re screwed. Or you use arping.

Usage

Options

-A

The same as -U, but ARP REPLY packets used instead of ARP REQUEST.

-b

Send only MAC level broadcasts. Normally arping starts from sending broadcast, and switch to unicast after reply received.

-c count

Stop after sending count ARP REQUEST packets. With deadline option, arping waits for count ARP REPLY packets, until the timeout expires.

-D

Duplicate address detection mode (DAD). See RFC2131, 4.4.1. Returns 0, if DAD succeeded i.e. no replies are received

-f

Finish after the first reply confirming that target is alive.

-I interface

Name of network device where to send ARP REQUEST packets. This option is required.

-h

Print help page and exit.

-q

Quiet output. Nothing is displayed.

-s source

IP source address to use in ARP packets. If this option is absent, source address is:

  • In DAD mode (with option -D) set to 0.0.0.0.
  • In Unsolicited ARP mode (with options -U or -A) set to destination.
  • Otherwise, it is calculated from routing tables.

-U

Unsolicited ARP mode to update neighbours’ ARP caches. No replies are expected.

-V

Print version of the program and exit.

-w deadline

Specify a timeout, in seconds, before arping exits regardless of how many packets have been sent or received. In this case arping does not stop after count packet are sent, it waits either for deadline expire or until countprobes are answered.

Example : Detect Duplicate IP Address With arping command 

Task: Send ARP request

Let us find out reachability of an IP on the local Ethernet with arping i.e send ARP request 192.168.1.1:

$ sudo arping -I eth0 -c 3 192.168.1.1

Output:

 

ARPING 192.168.1.1 from 192.168.1.106 ra0

Unicast reply from 192.168.1.1 [00:18:39:6A:C6:8B]  2.232ms
Unicast reply from 192.168.1.1 [00:18:39:6A:C6:8B]  1.952ms

Sent 3 probes (1 broadcast(s))

Received 3 response(s)

Where,

  • -I eth0 : Specify network interface i.e. name of network device where to send ARP REQUEST packets. This option is required.

  • -c 3 : Stop after sending 3 ARP REQUEST packets

Task: Find duplicate IP

 

The -D option specifies duplicate address detection mode (DAD). It returns exit status 0, if DAD succeeded i.e. no replies are received.

$ sudo arping -D -I eth0 -c 2 192.168.1.1

If 192.168.1.1 duplicated you should see zero exit status:

$ echo $?

Always use following syntax for duplicate address detection with arping:

$ sudo arping -D -I <interface-name> -c 2 <IP-ADDRESS-TO-TEST>
$ echo $?
0 Comments

Leave a reply

CONTACT US

We're are building as a community and a team. Be a part of it.

Sending

©2017 Ztrela Knowledge Solutions Pvt. Ltd

Log in with your credentials

Forgot your details?