arping command is like
ping, but only for local networks. Its advantage is that it works at a lower network level and sometimes receives responses when
ping can not. Here’s how to use it.
An IP address is a numerical label for a network device. It is used as an address so that the appropriate network traffic arrives at the correct device. But most devices on local networks have dynamic IP addresses. This means their IP address may change the next time they start.
In order to correctly route network traffic to the appropriate device, a scheme that maps IP addresses to Media Access Control (MAC) addresses must be used. The MAC address is a unique identity established at the place of manufacture of the device. The IP address is a logical address. The MAC address is a physical address.
Address Resolution Protocol is an intermediary that maps IP addresses to MAC addresses. The device responsible for queuing and routing network packets on your network—usually a router—creates and maintains an ARP table that associates IP addresses with MAC addresses.
If a router needs to route data to a device it doesn’t know about, it creates an ARP request to get the MAC address for the new device.
When a new device joins your network, it’s assigned an IP address, but that’s not enough to actually route traffic to it. The router needs to get the MAC address, which is the missing piece of the puzzle. But since the IP address alone is not enough information to route packets to the device, Catch-22 cannot use the IP address to query the hardware to obtain the MAC address.
The open systems interconnection model groups the technologies that make up a functioning network into a number of layers. Higher layers cannot function without lower layers. There are seven layers in the OSI model.
- Layer 7 is the highest layer, application layer. It provides information to the computer user and receives information back from them.
- Layer 6 is presentation layer. This ensures that the data is in the correct format or state as it moves to and from the network format. Encryption and decryption takes place at this layer.
- Layer 5 is meeting layer. A session is a network connection between two or more devices. This layer deals with matters such as connection initiation, handshaking, timeouts, and termination of connections that are no longer required.
- Layer 4 is transport layer. This is the layer that moves data across the network in a coordinated manner. This layer deals with things like transfer rates and data volumes. Transmission Control Protocol – TCP in TCP/IP works on this layer.
- Layer 3 is Sew layer. This is where packet routing and forwarding takes place. It is the layer on which the Internet Protocol works – IP in TCP/IP.
- Layer 2 is data connection layer. It is used to send packets between directly addressable devices using broadcasts to each device or unicasts to specific MAC addresses.
- Layer 1 is physical layer. This refers to the physical infrastructure including cabling, routers and network switches. The radio waves used in Wi-Fi would also fall into this category.
When a router receives a packet for an IP address that is not in its table, it broadcasts the packet to the entire network. It effectively asks, “Who has this IP address? This is a layer 2 message, so it does not rely on IP routing.
The device with the matching address responds by sending back its MAC address. The IP address and MAC address of this device can be added to the mapping table. Normal IP traffic can now be routed to the device because the relationship between its IP address and MAC address has been established and recorded.
RELATED: The foundation of the Internet: TCP/IP turns 40
The arping command
All the smart ARP stuff runs automatically in the background, creating and maintaining the ARP table. The
arping brings some ARP query functionality to a terminal window. It operates at OSI layer two and may require a response from the device when
On Fedora 36,
arping it was already installed but we needed to install it on Manjaro 21 and Ubuntu 22.04.
On Ubuntu the command is:
sudo apt install arping
On Manjaro you need to type:
sudo pacman -Sy arping
The easiest way to use
arping is with an IP address. It must be the address of a directly addressable device connected to the local network. Because
arping operates at layer two, no routing is possible. You will have to use
sudo arping 192.168.1.17
Press Ctrl+C to stop. The returned information is the MAC address of the corresponding device, the index number
arping requirement and round trip time for
arping request for completion.
Compare the output with the output from
ping command, below. The
ping the command returns additional information about the network packet backhaul timing. The
arping it will give you less time statistics but includes the MAC address of the device.
You can also use the device’s network name with
sudo arping fedora-36.local
You can use
-c (number) option to say
arping stop after a set number of requests. This command says
arping try twice and then stop.
sudo arping -c 2 192.168.1.18
If you have multiple network interfaces on your computer, you can use
-I (interface) option to say
arping what interface to use.
You can use
ip link command to display a list of network interfaces.
This computer has three interfaces. The
lo a virtual interface is used as a loopback for internal communication between software on the same computer. It’s of no use to us here. We can use either ethernet connection
enp3s0 or wireless interface
This command says
arping use the interface we choose and not make our own choices.
sudo arping -c 2 -I enp3s0 manjaro-21.local
Using arp in scripts
arping in a loop in the script we can make it work over a range of IP addresses. Copy the text from this script and save it in a file called “scan-range.sh”.
You will need to edit the script and replace all occurrences of 192.168.1 with your network’s IP address.
#!/bin/bash for ((device=$1; device<=$2; device++)) do arping -c 1 192.168.1.$device | grep -E "1 response|1 packets received" > /dev/null if [ $? == 0 ]; then echo "192.168.1.$device responded." else echo "192.168.1.$device didn't respond." fi done
The script accepts two command line parameters. These are used as the last octet of the IP address range you want to use
arping on. So if you pass 20 and 30 to the script, the loop will start at 192.168.1.20 and ends after using the IP address 192.168.1.30.
Parameters are accessed inside the script as
$2. These are used in C style
for loop. At every turn
$device is set to the next IP address in the range.
The script uses the same
arping -c format we’ve seen before, but this time we’re only asking for a single ARP request to be sent to each device in range.
arping the command is passed through the pipeline
grep the syntax can be simplified in the script.
grep it looks for one of two strings, either “1 response” or “1 packet received”. This is because the test computers had different versions
arping on them and use different terminology. If
grep finds any of these phrases, its output value will be zero.
When you know which of the phrases is your version
arping use, you can simplify
grep syntax by removing the second phrase.
if sentence tests
$?—a variable that contains the exit code of the last terminated process — to see if it is null. If it is, it uses it
echo print a success message to the terminal window. If the test fails, so be it
grep did not find any of the strings, which means the ARP request failed.
Make your script executable with
chmod command a
chmod +x scan-range.sh
We’ll run it and scan the IP range from 15 to 20. Some of these addresses don’t have devices attached, so we should see some errors. Don’t forget to use
sudo . We’ll try that too
ping device at 192.168.1.15.
sudo ./scan-range.sh 15 20
We get a mix of hits and misses like you would on any network. Note, however, that although the device at 192.168.1.15 responds to a layer two ARP request, it does not respond to a layer three request
If you’ve pinged a device and experienced a failure, you’d probably be inclined to check if it’s connected, online, and
ping out device 192.168.1.15.
arping you can verify that it is connected, online and available over the network. This would direct your troubleshooting to start looking at routing and ARP table issues.
The net onion has many layers. If
ping it doesn’t go anywhere, expand the layer and see what
arping can tell you
RELATED: How to Manage Linux Wi-Fi Networks with Nmtui