arping

arping is a computer software tool that is used to discover hosts on a computer network. The program tests whether a given IP address is in use on the local network, and can get additional information about the device using that address.

The arping tool is analogous in function to ping, which probes hosts using the Internet Control Message Protocol (ICMP). This is a routable protocol that operates at layer 3 of the OSI model. Arping operates at the layer 2 (or the link layer of the OSI model) - using the Address Resolution Protocol (ARP) for probing hosts. Since ARP is non-routable, this only works for the local network. However, in networks employing repeaters that use proxy ARP, the ARP response may be coming from such proxy hosts and not from the probed target.

There are two popular arping implementations. One is part of Linux iproute2 suite, and cannot resolve MAC addresses to IP addresses. The other arping implementation, written by Thomas Habets, can ping hosts by MAC address as well as by IP address, and adds more features.

Having both arping implementations on a system may introduce conflicts. Ubuntu handles this by removing iproute2 arping if Habets's arping is installed - which removes the NetworkManager, which requires the iproute2 arping.

Example

Example session output of iputils from iproute:

ARPING 192.168.39.120 from 192.168.39.1 eth0
Unicast reply from 192.168.39.120 [00:01:80:38:F7:4C]  0.810ms
Unicast reply from 192.168.39.120 [00:01:80:38:F7:4C]  0.607ms
Unicast reply from 192.168.39.120 [00:01:80:38:F7:4C]  0.602ms
Unicast reply from 192.168.39.120 [00:01:80:38:F7:4C]  0.606ms
Sent 4 probes (1 broadcast(s))
Received 4 response(s)

Example session output from Thomas Habets's arping:

ARPING 192.168.16.96
60 bytes from 00:04:5a:4b:b6:ec (192.168.16.96): index=0 time=292.000 usec
60 bytes from 00:04:5a:4b:b6:ec (192.168.16.96): index=1 time=310.000 usec
60 bytes from 00:04:5a:4b:b6:ec (192.168.16.96): index=2 time=256.000 usec
^C
--- 192.168.16.96 statistics ---
3 packets transmitted, 3 packets received,   0% unanswered (0 extra)

See also

• arpwatch

External links

• Thomas Habets's arping
• iproute2 suite (including arping)
• A fully functional arping implementation in 26 lines of Python code, using scapy
• arping(8) – Linux Administration and Privileged Commands Manual