Understanding Network Connectivity: arping command on Linux

In this tutorial, How to use arping command on Linux. It is like ping command in Linux. but for local network only. arping command operates at a lower networking level.

What is arping?

arping is a command-line utility on Linux that allows users to send ARP (Address Resolution Protocol) requests to a specific IP address on the network.

ARP is responsible for mapping IP addresses to physical MAC (Media Access Control) addresses, which are essential for data transmission over local networks.

The Basic Syntax

The basic syntax of the arping command is as follows:

arping [options] target_ip

arping: The name of the command itself.
[options]: Optional flags that modify the behavior of the command.
target_ip: The IP address of the host you want to target with ARP requests.

How to use arping command on Linux

arping command was already installed on Linux, but you need to install it as below:

On Ubuntu

sudo apt install arping

arping command on Linux

On Manjaro

sudo pacman -Sy arping

The simple way to use arping command with an IP address.

sudo arping 192.168.1.19

You can use the -c (count) option to tell arping to stop after a set number of requests.

sudo arping -c 3 192.168.1.19

Specify Network Interface

sudo arping -c 3 -I enp3s0 192.168.1.19

Specify Source MAC Address

sudo arping -c 7 -s xxxxx.x.x.x.x.x.x.xx 192.168.1.19

Specify Source IP Address

sudo arping -c 7 -s 192.168.1.12 192.168.1.19

Broadcasting ARP Requests

arping -b 192.168.1.19

arping help page

arping --help

vagrant@controller:~$ arping --help
ARPing 2.21, by Thomas Habets <[email protected]>
usage: arping [ -0aAbdDeFpPqrRuUv ] [ -w <sec> ] [ -W <sec> ] [ -S <host/ip> ]
              [ -T <host/ip ] [ -s <MAC> ] [ -t <MAC> ] [ -c <count> ]
              [ -C <count> ] [ -i <interface> ] [ -m <type> ] [ -g <group> ]
              [ -V <vlan> ] [ -Q <priority> ] <host/ip/MAC | -B>

Options:

    -0     Use this option to ping with source IP address 0.0.0.0. Use this
           when you haven't configured your interface yet. Note that this
           may get the MAC-ping unanswered.   This is an alias for -S
           0.0.0.0.
    -a     Audiable ping.
    -A     Only count addresses matching requested address (This *WILL*
           break most things you do. Only useful if you are arpinging many
           hosts at once. See arping-scan-net.sh for an example).
    -b     Like -0 but source broadcast source address (255.255.255.255).
           Note that this may get the arping unanswered since it's not nor-
           mal behavior for a host.
    -B     Use instead of host if you want to address 255.255.255.255.
    -c count
           Only send count requests.
    -C count
           Only wait for this many replies, regardless of -c and -w.
    -d     Find duplicate replies. Exit with 1 if there are answers from
           two different MAC addresses.
    -D     Display answers as exclamation points and missing packets as dots.
    -e     Like -a but beep when there is no reply.
    -F     Don't try to be smart about the interface name. (even if this
           switch is not given, -i overrides smartness)
    -g group
           setgid() to this group instead of the nobody group.
    -h     Displays a help message and exits.
    -i interface
           Use the specified interface.
    -m type
           Type of timestamp to use for incoming packets. Use -vv when
           pinging to list available ones.
    -q     Does not display messages, except error messages.
    -Q pri 802.1p priority to set. Should be used with 802.1Q (-V).
           Defaults to 0.
    -r     Raw output: only the MAC/IP address is displayed for each reply.
    -R     Raw output: Like -r but shows "the other one", can be combined
           with -r.
    -s MAC Set source MAC address. You may need to use -p with this.
    -S IP Like -b and -0 but with set source address. Note that this may
           get the arping unanswered if the target does not have routing to
           the IP. If you don't own the IP you are using, you may need to
           turn on promiscious mode on the interface (with -p). With this
           switch you can find out what IP-address a host has without tak-
           ing an IP-address yourself.
    -t MAC Set target MAC address to use when pinging IP address.
    -T IP Use -T as target address when pinging MACs that won't respond to
           a broadcast ping but perhaps to a directed broadcast.
           Example:
           To check the address of MAC-A, use knowledge of MAC-B and IP-B.
           $ arping -S <IP-B> -s <MAC-B> -p <MAC-A>
    -p     Turn on promiscious mode on interface, use this if you don't
           "own" the MAC address you are using.
    -P     Send ARP replies instead of requests. Useful with -U.
    -u     Show index=received/sent instead of just index=received when
           pinging MACs.
    -U     Send unsolicited ARP.
    -v     Verbose output. Use twice for more messages.
    -V num 802.1Q tag to add. Defaults to no VLAN tag.
    -w sec Specify a timeout before ping exits regardless of how many
packets have been sent or received.
    -W sec Time to wait between pings.
Report bugs to: [email protected]
Arping home page: <http://www.habets.pp.se/synscan/>
Development repo: http://github.com/ThomasHabets/arping

Conclusion

The arping command on Linux is a powerful tool for diagnosing network connectivity issues and verifying the presence of devices on a local network. By sending ARP requests to target IP addresses, you can quickly determine if a device is active and obtain its MAC address. Understanding how to use arping effectively can be immensely valuable for network administrators and enthusiasts alike.

Remember, while arping is a valuable tool for local network diagnostics, it should be used responsibly and only on networks that you have permission to access.

Search This Blog