How to use the command 'arping' (with examples)

Arping is a command-line utility that allows network administrators and enthusiasts to discover and probe hosts within a network using the Address Resolution Protocol (ARP). Its primary function is to discover and verify hosts on a local network. Arping is notable for its capability to send ARP request packets to obtain MAC address information, making it especially useful for network troubleshooting, auditing, and management. Below, I will explore various use cases of the ‘arping’ command with practical examples.

Use case 1: Ping a host by ARP request packets

Code:

arping host_ip

Motivation:

When you need to verify if a specific host is active on a local network, using ARP request packets is a direct way to check its availability. This can be particularly helpful if ICMP packets (used by regular ‘ping’) are blocked or filtered on the network, as ARP requests usually remain unrestricted on local networks.

Explanation:

• arping: The command used to initiate the ARP request.
• host_ip: The IP address of the host you want to ping to verify its presence on the network.

Example output:

ARPING 192.168.1.10
60 bytes from 00:1e:65:10:50:f2 (192.168.1.10): index=0 time=1.005 msec
60 bytes from 00:1e:65:10:50:f2 (192.168.1.10): index=1 time=0.915 msec
60 bytes from 00:1e:65:10:50:f2 (192.168.1.10): index=2 time=0.915 msec

Use case 2: Ping a host on a specific interface

Code:

arping -I interface host_ip

Motivation:

In complex network setups where multiple network interfaces are involved, it’s essential to specify the interface from which ARP requests should be sent. This ensures that the ARP probing targets the correct segment of the network, aiding in precise diagnostics and reducing unnecessary network traffic.

Explanation:

• -I interface: This specifies the network interface (’eth0’, ‘wlan0’, etc.) through which the ARP packets should be sent.
• host_ip: The target IP address of the host you wish to ping.

Example output:

ARPING 192.168.1.10 from 192.168.1.5 eth0
60 bytes from 00:1e:65:10:50:f2 (192.168.1.10): index=0 time=1.215 msec
60 bytes from 00:1e:65:10:50:f2 (192.168.1.10): index=1 time=1.092 msec
60 bytes from 00:1e:65:10:50:f2 (192.168.1.10): index=2 time=1.060 msec

Use case 3: Ping a host and finish after the first reply

Code:

arping -f host_ip

Motivation:

In scenarios where you only need confirmation that a host is up without needing a continuous stream of replies, immediately terminating after the first successful response saves time and system resources. This can be particularly useful in scripts and automated tasks that need a quick availability check.

Explanation:

• -f: This option tells ‘arping’ to stop the process once it receives the first reply.
• host_ip: The IP address of the host you are testing.

Example output:

ARPING 192.168.1.10
60 bytes from 00:1e:65:10:50:f2 (192.168.1.10): index=0 time=1.101 msec

Use case 4: Ping a host a specific number of times

Code:

arping -c count host_ip

Motivation:

Limiting the number of ARP requests made to a host is beneficial for controlling network traffic, especially in large environments. By specifying a count, users can obtain a bounded dataset, which is useful for obtaining averaged latency or verifying intermittent connectivity issues.

Explanation:

• -c count: Designates the number of ARP requests to send before exiting.
• host_ip: The target IP address for the ARP ping.

Example output:

ARPING 192.168.1.10
60 bytes from 00:1e:65:10:50:f2 (192.168.1.10): index=0 time=1.019 msec
60 bytes from 00:1e:65:10:50:f2 (192.168.1.10): index=1 time=0.958 msec
60 bytes from 00:1e:65:10:50:f2 (192.168.1.10): index=2 time=0.982 msec

Use case 5: Broadcast ARP request packets to update neighbours’ ARP caches

Code:

arping -U ip_to_broadcast

Motivation:

Broadcasting ARP requests can refresh and update the ARP cache entries of neighbor hosts. This is crucial when IP addresses change or after rebooting network devices, ensuring that communication continues smoothly on the network without address resolution issues.

Explanation:

• -U: Uses Unsolicited ARP mode, which broadcasts ARP requests rather than targeting a specific host.
• ip_to_broadcast: The IP address to use in the ARP broadcast packets.

Example output:

ARPING 192.168.1.255 from 192.168.1.10
Sent 1 probe(s) (255.255.255.255) for 192.168.1.10

Use case 6: Detect duplicated IP addresses in the network

Code:

arping -D -w 3 ip_to_check

Motivation:

Identifying duplicate IP addresses is fundamental to maintaining network integrity. Duplications can cause severe connectivity issues. The command effectively detects duplicates by sending ARP requests and identifying conflicting MAC addresses.

Explanation:

• -D: Activates duplicate address detection mode.
• -w 3: Sets a wait time of 3 seconds for each reply before concluding the detection process.
• ip_to_check: The IP address suspected of duplication within the network.

Example output:

ARPING 192.168.1.50
Duplicated address 192.168.1.50 used by 00:1e:65:10:50:f3

Conclusion:

The ‘arping’ command serves as a powerful tool for network management and troubleshooting, especially in environments where control over ARP communication is crucial. Mastering the various options and use cases of ‘arping’ allows network administrators to maintain robust network operations and swiftly address connectivity issues.