Arping
Encyclopedia
arping is a computer software tool that is used to discover hosts on a computer network
. The program tests whether a given IP address
is in use on the local network, and can get additional information about the device using that address.
The arping tool is analogous in function to ping
, which probes hosts using the Internet Control Message Protocol
(ICMP). This is a routable protocol that operates at layer 3
of the OSI model
. Arping operates at the layer 2
(or the link layer
of the OSI model) - using the Address Resolution Protocol
(ARP) for probing hosts. Since ARP is non-routable, this only works for the local network. However, in networks employing repeaters that use proxy ARP
, the ARP response may be coming from such proxy hosts and not from the probed target.
There are two popular arping implementations. One is part of Linux iproute2
suite, and cannot resolve MAC addresses to IP addresses. The other arping implementation, written by Thomas Habets, can ping hosts by MAC address as well as by IP address, and adds more features.
Having both arping implementations on a system may introduce conflicts. Ubuntu
handles this by removing iproute2 arping if Habets's arping is installed - which removes the NetworkManager
, which requires the iproute2 arping.
Example session output from Thomas Habets's arping:
Computer network
A computer network, often simply referred to as a network, is a collection of hardware components and computers interconnected by communication channels that allow sharing of resources and information....
. The program tests whether a given IP address
IP address
An Internet Protocol address is a numerical label assigned to each device participating in a computer network that uses the Internet Protocol for communication. An IP address serves two principal functions: host or network interface identification and location addressing...
is in use on the local network, and can get additional information about the device using that address.
The arping tool is analogous in function to ping
Ping
Ping is a computer network administration utility used to test the reachability of a host on an Internet Protocol network and to measure the round-trip time for messages sent from the originating host to a destination computer...
, which probes hosts using the Internet Control Message Protocol
Internet Control Message Protocol
The Internet Control Message Protocol is one of the core protocols of the Internet Protocol Suite. It is chiefly used by the operating systems of networked computers to send error messages indicating, for example, that a requested service is not available or that a host or router could not be...
(ICMP). This is a routable protocol that operates at layer 3
Network Layer
The network layer is layer 3 of the seven-layer OSI model of computer networking.The network layer is responsible for packet forwarding including routing through intermediate routers, whereas the data link layer is responsible for media access control, flow control and error checking.The network...
of the OSI model
OSI model
The Open Systems Interconnection model is a product of the Open Systems Interconnection effort at the International Organization for Standardization. It is a prescription of characterizing and standardizing the functions of a communications system in terms of abstraction layers. Similar...
. Arping operates at the layer 2
Link Layer
In computer networking, the link layer is the lowest layer in the Internet Protocol Suite , the networking architecture of the Internet . It is the group of methods or protocols that only operate on a host's link...
(or the link layer
Link Layer
In computer networking, the link layer is the lowest layer in the Internet Protocol Suite , the networking architecture of the Internet . It is the group of methods or protocols that only operate on a host's link...
of the OSI model) - using the Address Resolution Protocol
Address Resolution Protocol
Address Resolution Protocol is a telecommunications protocol used for resolution of network layer addresses into link layer addresses, a critical function in multiple-access networks. ARP was defined by RFC 826 in 1982. It is Internet Standard STD 37...
(ARP) for probing hosts. Since ARP is non-routable, this only works for the local network. However, in networks employing repeaters that use proxy ARP
Proxy ARP
Proxy ARP is a technique by which a device on a given network answers the ARP queries for a network address that is not on that network...
, the ARP response may be coming from such proxy hosts and not from the probed target.
There are two popular arping implementations. One is part of Linux iproute2
Iproute2
iproute2 is a collection of utilities for controllingTCP and UDP IP networking and traffic control in Linux, in both IPv4 and IPv6 networks. It is currently maintained by Stephen Hemminger...
suite, and cannot resolve MAC addresses to IP addresses. The other arping implementation, written by Thomas Habets, can ping hosts by MAC address as well as by IP address, and adds more features.
Having both arping implementations on a system may introduce conflicts. Ubuntu
Ubuntu (operating system)
Ubuntu is a computer operating system based on the Debian Linux distribution and distributed as free and open source software. It is named after the Southern African philosophy of Ubuntu...
handles this by removing iproute2 arping if Habets's arping is installed - which removes the NetworkManager
NetworkManager
Network Manager is a software utility aimed at simplifying the use of computer networks on Linux-based and other Unix-like operating systems.- Overview :...
, which requires the iproute2 arping.
Example
Example session output of iputils from iproute:
ARPING 192.168.39.120 from 192.168.39.1 eth0
Unicast reply from 192.168.39.120 [00:01:80:38:F7:4C] 0.810ms
Unicast reply from 192.168.39.120 [00:01:80:38:F7:4C] 0.607ms
Unicast reply from 192.168.39.120 [00:01:80:38:F7:4C] 0.602ms
Unicast reply from 192.168.39.120 [00:01:80:38:F7:4C] 0.606ms
Sent 4 probes (1 broadcast(s))
Received 4 response(s)
Example session output from Thomas Habets's arping:
ARPING 192.168.16.96
60 bytes from 00:04:5a:4b:b6:ec (192.168.16.96): index=0 time=292.000 usec
60 bytes from 00:04:5a:4b:b6:ec (192.168.16.96): index=1 time=310.000 usec
60 bytes from 00:04:5a:4b:b6:ec (192.168.16.96): index=2 time=256.000 usec
^C
--- 192.168.16.96 statistics ---
3 packets transmitted, 3 packets received, 0% unanswered (0 extra)