arping
Ping destination on device interface by ARP packets, using source address source.
OPTIONS
The same as -U, but ARP REPLY packets used instead of ARP REQUEST.
Send only MAC level broadcasts. Normally arping starts from sending broadcast, and switch to unicast after reply received.
Stop after sending count ARP REQUEST packets. With deadline option, instead wait for count ARP REPLY packets, or until the timeout expires.
Duplicate address detection mode (DAD). See RFC2131, 4.4.1. Returns 0, if DAD succeeded i.e. no replies are received.
Finish after the first reply confirming that target is alive.
Name of network device where to send ARP REQUEST packets.
Quiet output. Nothing is displayed.
IP source address to use in ARP packets. If this option is absent, source address is:
· In DAD mode (with option -D) set to 0.0.0.0.
· In Unsolicited ARP mode (with options -U or -A) set to destination.
· Otherwise, it is calculated from routing tables.
Unsolicited ARP mode to update neighbours ARP caches. No replies are expected.
Print version of the program and exit.
Specify a timeout, in seconds, before arping exits regardless of how many packets have been sent or received. In this case arping does not stop after count packet are sent, it waits either for deadline expire or until count probes are answered.
Specify an interval, in seconds, between packets.
SECURITY
arping requires CAP_NET_RAW capability to be executed. It is not recommended to be used as set-uid root, because it allows user to modify ARP caches of neighbour hosts.
AVAILABILITY
arping is part of iputils package.
How To Ping MAC Address
Pinging ports and computers is probably one of the best troubleshooting methods available.
Used by network administrators daily, “ping” can be quite useful in order to see if a host is up or not.
However, in some cases, you may need to be able to ping a MAC address in order to see if the host is up or not.
In this tutorial, we are going to explain how you can easily ping a MAC address on various operating systems (Windows and Linux).
Ping MAC Address on Windows
The easiest way to ping a MAC address on Windows is to use the “ping” command and to specify the IP address of the computer you want to verify.
Whether the host is contacted, your ARP table will be populated with the MAC address, thus validating that the host is up and running.
First of all, open a command line on Windows with Administrator privileges.
In order to open CMD, you can go to the bottom left corner of your Windows Desktop, and search for “CMD“.
When your command line is open, hit the “arp” command with the “-a” in order to see your current ARP table.
If you need help on how ARP and MAC are linked, this is already explained in one of our tutorials on MAC addresses.
By default, the ARP command will list your network interfaces and the entries (IP address with MAC addresses) that are already known by your operating system.
In this case, as you can see, we have two network interfaces having one ARP entry each (configured as static).
For those who are curious, the 01-00-5E prefix is the start for multicast MAC addresses assigned by the IANA.
Now let’s say that we want to know the MAC adress of our default gateway available at 192.168.178.1/24.
In order to ping this MAC address, we are going to use the “ping” command and specify the IP address to be used.
Under the hood, your operating system will first send a ARP ping request followed by an ICMP request to the corresponding request.
As you can see, the “ping” was successful in our case : we got some replies from the distant host.
Now, let’s see the corresponding MAC address by using the “arp” command followed by the “-a” option.
As you can see, the MAC address of this router is CC-CE-1E (which is used by the AVM Audiovisuelles company)
Congratulations, you successfully pinged a MAC address on Windows 10!
ARP Ping on Windows
For those who are familiar with Linux, you probably know about the arpping command.
Luckily for you, there is an arpping command on Windows under the “arp-ping” name.
In order to use the arpping command, you can go to the official page of this command for Windows.
In there, simply click on the “arp-ping.exe” and store the executable wherever you want on your computer.
Next, open a CMD console (the way you opened it in the previous section) and navigate to the folder where you stored your “arp-ping.exe” executable.
In order to achieve that, you can use the “cd” command.
When you are in your folder, execute the “arp-ping” command and specify the IP address to be pinged with the command.
For this tutorial, let’s assume that we want to ping the default gateway of your local network located at 192.168.178.1/24.
As a consequence, we would type the following command
Awesome, you successfully pinged your MAC address on Windows using the “arp-ping” command.
Ping MAC Address on Linux
The easiest way to ping a MAC address on Linux is to use the “arping” command and to specify the IP address to be pinged.
Similarly to Windows, if the host pings back, you will be presented with the MAC address you are interested in.
By pinging the default gateway of this local network, we were able to determine that the MAC address 00:00:5E:00:01:6E is up and running.
Note that the arping command may not be installed by default on your system, you will need to install it.
In order to install it, you need sudo privileges.
If you are not sure about how you can get sudo privileges on Linux, there are many different tutorials that you can use for Debian or CentOS.
When you have administrator privileges, simply execute the “apt-get install” command and install the arping utility.
$ sudo apt-get install arpingFinally, when the command is properly installed, you will be able to ping the MAC address correctly.
Congratulations, you were able to successfully ping a MAC address on Linux!
Difference between ARP and ICMP
To be extremely clear, there is no such thing as “pinging” a MAC address.
This article was named this way because many developers and engineers are searching for it this way, but this is partially correct.
When users refer to “ping”, they actually refer to the ICMP protocol which is a protocol used in order to diagnose and troubleshoot issues happening over a network.
However, if you learnt about the OSI model you probably know that MAC addresses are used on the layer two of the OSI model (data-link layer).
ICMP, however, is used on the Internet layer, meaning that there is no such thing as “pinging a MAC address“.
Under the hood, you are actually sending an ARP request first, waiting for the host to respond and learning about its MAC address.
When you are aware of the MAC address, you can actually send an ICMP request to the host in order to get the diagnosis back.
Conclusion
In this tutorial, you learnt how you can easily ping a MAC address on Windows and Linux.
If you are interested in MAC addresses or in networking, we have a complete series of tutorials available in our blog, make sure to check it out!
Icons made by Pixel Perfect and FreePik from Flaticon.
Ping by arp linux
NAME
arping - sends arp and/or ip pings to a given host
SYNOPSIS
arping [-0aAbBdDeFhpqrRuUv] [-S host/ip] [-T host/ip] [-s MAC] [-t MAC] [-c count] [-i interface] [ -w seconds ] [ -W seconds ] [ -V vlan ] [ -Q priority ] [ -g group ] host | -B> arping --help
DESCRIPTION
The arping utility sends ARP and/or ICMP requests to the specified host and displays the replies. The host may be specified by its hostname, its IP address, or its MAC address. One request is sent each second. When pinging an IP an ARP who-has query is sent. When pinging a MAC address a directed broadcast ICMP Echo request is sent. For more technical explanation and an FAQ, see the README file. Note on timing ARP packets are usually replied to (on a LAN) so fast that the OS task scheduler can’t keep up to get exact enough timing. On an idle system the roundtrip times will be pretty much accurate, but with more load the timing gets less exact. To get more exact timing on a non-idle system, re-nice arping to -15 or so. # nice -n -15 arping foobar This is not just an issue with arping, it is with normal ping also (at least it is on my system). But it doesn’t show up as much with ping since arping packets (when pinging IP) doesn’t traverse the IP stack when received and are therefore replied to faster.
OPTIONS
--help Show extended help. Not quite as extensive as this manpage, but more than -h. -0 Use this option to ping with source IP address 0.0.0.0. Use this when you haven’t configured your interface yet. Note that this may get the MAC-ping unanswered. This is an alias for -S 0.0.0.0. -a Audible ping. -A Only count addresses matching requested address (This *WILL* break most things you do. Only useful if you are arpinging many hosts at once. See arping-scan-net.sh for an example). -b Like -0 but source broadcast source address (255.255.255.255). Note that this may get the arping unanswered since it’s not normal behavior for a host. -B Use instead of host if you want to address 255.255.255.255. -c count Only send count requests. -C count Only wait for count replies, regardless of -c and -w. -d Find duplicate replies. Exit with 1 if there are answers from two different MAC addresses. -D Display answers as exclamation points and missing packets as dots. Like flood ping on a Cisco. -e Like -a but beep when there is no reply. -F Don’t try to be smart about the interface name. Even if this switch is not given, -i disables this smartness. -g group setgid() to this group instead of the nobody group. -h Displays a help message and exits. -i interface Don’t guess, use the specified interface. -m type Type of timestamp to use for incoming packets. Use -vv when pinging to list available ones. -p Turn on promiscious mode on interface, use this if you don’t "own" the MAC address you are using. -P Send ARP replies instead of requests. Useful with -U. -q Does not display messages, except error messages. -Q priority 802.1p priority to set. Should be used with 802.1Q tag (-V). Defaults to 0. -r Raw output: only the MAC/IP address is displayed for each reply. -R Raw output: Like -r but shows "the other one", can be combined with -r. -s MAC Set source MAC address. You may need to use -p with this. -S IP Like -b and -0 but with set source address. Note that this may get the arping unanswered if the target does not have routing to the IP. If you don’t own the IP you are using, you may need to turn on promiscious mode on the interface (with -p). With this switch you can find out what IP-address a host has without taking an IP-address yourself. -t MAC Set target MAC address to use when pinging IP address. -T IP Use -T as target address when pinging MACs that won’t respond to a broadcast ping but perhaps to a directed broadcast. Example: To check the address of MAC-A, use knowledge of MAC-B and IP-B. $ arping -S -s -p -u Show index=received/sent instead of just index=received when pinging MACs. -U Send unsolicited ARP. This sets the destination MAC address in the ARP frame to the broadcast address. Unsolicited ARP is used to update the neighbours’ ARP caches. Example: $ arping -i -U -v Verbose output. Use twice for more messages. -V vlan VLAN tag to set. Defaults to no VLAN tag. -w sec Specify a timeout before ping exits regardless of how many packets have been sent or received. -W sec Time to wait between pings.
EXAMPLES
# arping -c 3 88.1.180.225 ARPING 88.1.180.225 60 bytes from 00:11:85:4c:01:01 (88.1.180.225): index=0 time=13.910 msec 60 bytes from 00:11:85:4c:01:01 (88.1.180.225): index=1 time=13.935 msec 60 bytes from 00:11:85:4c:01:01 (88.1.180.225): index=2 time=13.944 msec --- 88.1.180.225 statistics --- 3 packets transmitted, 3 packets received, 0% unanswered # arping -c 3 00:11:85:4c:01:01 ARPING 00:11:85:4c:01:01 60 bytes from 88.1.180.225 (00:11:85:4c:01:01): icmp_seq=0 time=13.367 msec 60 bytes from 88.1.180.225 (00:11:85:4c:01:01): icmp_seq=1 time=13.929 msec 60 bytes from 88.1.180.225 (00:11:85:4c:01:01): icmp_seq=2 time=13.929 msec --- 00:11:85:4c:01:01 statistics --- 3 packets transmitted, 3 packets received, 0% unanswered # arping -C 2 -c 10 -r 88.1.180.225 00:11:85:4c:01:01 00:11:85:4c:01:01
BUGS
You have to use -B instead of arpinging 255.255.255.255, and -b instead of -S 255.255.255.255. This is libnets fault.
SEE ALSO
ping(8), arp(8), rarp(8)
AUTHOR
Arping was written by Thomas Habets thomas@habets.se>. http://www.habets.pp.se/synscan/ git clone http://github.com/ThomasHabets/arping.git