CompTIA Certifications

CompTIA Network+ 2009 Domain 5: Network Tools

Arp Ping Networking Utility

The arping utility on Unix/Linux/Mac OS X systems is used to send an ARP request to a system on the network. IPv4 devices must respond to an ARP request, unlike a normal ping which might be declined at the firewall or other security device. ARP requests are not normally routed, so you cannot arping a device across the Internet to see if it’s up. What this means is the ARP request is not sent from one router to another, so an ARP request will fail at the router level.

To form an arping request, here is the usage:

root@thatcommunity [/sbin]# /sbin/arping
Usage: arping [-fqbDUAV] [-c count] [-w timeout] [-I device] [-s source] destination
 -f : quit on first reply
 -q : be quiet
 -b : keep broadcasting, don't go unicast
 -D : duplicate address detection mode
 -U : Unsolicited ARP mode, update your neighbours
 -A : ARP answer mode, update your neighbours
 -V : print version and exit
 -c count : how many packets to send
 -w timeout : how long to wait for a reply
 -I device : which ethernet device to use (eth0)
 -s source : source ip address
 destination : ask for what ip address

When you actually use arping, the output looks like this:

root@thatcommunity [/sbin]# /sbin/arping
ARPING from eth0
Unicast reply from [00:00:0C:07:AC:CD]  1.406ms
Unicast reply from [00:00:0C:07:AC:CD]  2.402ms
Unicast reply from [00:00:0C:07:AC:CD]  1.887ms
Unicast reply from [00:00:0C:07:AC:CD]  5.152ms
Unicast reply from [00:00:0C:07:AC:CD]  76.378ms
Unicast reply from [00:00:0C:07:AC:CD]  2.054ms
Unicast reply from [00:00:0C:07:AC:CD]  2.322ms
Unicast reply from [00:00:0C:07:AC:CD]  48.561ms
Unicast reply from [00:00:0C:07:AC:CD]  109.788ms
Sent 16 probes (1 broadcast(s))
Received 9 response(s)

You can see it received 9 responses before we canceled the arping. It shows the IP address and corresponding MAC address and the amount of time it took to receive a response.